CVE-2020-8256: Ivanti Connect Secure

Medium severity, CVSS 4.9. EPSS: 3.4% chance of exploitation in the next 30 days.

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.

Affected products

• Ivanti Connect Secure: version 9.1 only
• Pulse Secure Pulse Connect Secure: up to and including 9.0

Published 2020-09-30. Last modified 2026-06-17.