CVE-2018-20306: Pulse Secure Virtual Traffic Manager

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.

Affected products

• Pulse Secure Virtual Traffic Manager: from 9.9, before 9.9r2 (fixed in 9.9r2); from 10.4, before 10.4r1 (fixed in 10.4r1); from 17.2, before 17.2r1 (fixed in 17.2r1)

Published 2018-12-20. Last modified 2026-06-17.