CVE-2016-4791: Ivanti Connect Secure

High severity, CVSS 8.6. EPSS: 2.2% chance of exploitation in the next 30 days.

The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors.

Affected products

• Ivanti Connect Secure: version 8.1 only; version 8.2 only; version 8.0 only
• Pulse Secure Pulse Connect Secure: version 8.1r1.0 only; version 7.4 only

Published 2016-05-26. Last modified 2026-06-17.