Critical Code Execution Vulnerability (CVE‑2020‑8243) in Ivanti Pulse Connect Secure
What It Is — Ivanti Pulse Connect Secure’s admin web interface contains an authentication‑required flaw that allows an attacker to upload a custom template and achieve arbitrary code execution.
Exploitability — The vulnerability can be exploited by any authenticated user; a public patch has been released. CVSS v3.1 base score 9.8 (Critical).
Affected Products — Ivanti Pulse Connect Secure (all versions prior to the security update).
Why It Matters for Trust & Control Assurance
- Continuous patch‑management evidence demonstrates due‑diligence for the “Vulnerability Management” control objective.
- Logging of admin‑portal activity provides defensible audit trails required for access‑control monitoring.
- Demonstrating timely remediation satisfies multiple framework controls (e.g., NIST CSF Identify‑Protect, ISO 27001 A.12.6).
Recommended Actions
- Deploy Ivanti’s patch for CVE‑2020‑8243 without delay.
- Restrict admin portal access to a minimal set of privileged accounts and enforce MFA.
- Enable comprehensive logging of template uploads and review logs for anomalous activity.
- Verify that your vulnerability‑remediation workflow captures this fix as evidence for audit readiness.
Source: CISA KEV – CVE‑2020‑8243