Read the docs
TI-2020-07190 Aliases CVE-2020-8956GHSA-rw4x-mrcc-6rwp

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals…

Priority LOW 18CWE-521Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-521.

Summary

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.

Why it matters now

EPSS 0.01155 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r1.0:*:*:*:*:*:*:*9.0r1.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r2.0:*:*:*:*:*:*:*9.0r2.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r2.1:*:*:*:*:*:*:*9.0r2.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r3.0:*:*:*:*:*:*:*9.0r3.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r3.1:*:*:*:*:*:*:*9.0r3.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r4.0:*:*:*:*:*:*:*9.0r4.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r4.1:*:*:*:*:*:*:*9.0r4.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r1.0:*:*:*:*:*:*:*9.1r1.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r2.0:*:*:*:*:*:*:*9.1r2.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r3.0:*:*:*:*:*:*:*9.1r3.0VulnerablePulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r1.0:*:*:*:*:*:*:* Versions 9.0r1.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r2.0:*:*:*:*:*:*:* Versions 9.0r2.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r2.1:*:*:*:*:*:*:* Versions 9.0r2.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r3.0:*:*:*:*:*:*:* Versions 9.0r3.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r3.1:*:*:*:*:*:*:* Versions 9.0r3.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r4.0:*:*:*:*:*:*:* Versions 9.0r4.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r4.1:*:*:*:*:*:*:* Versions 9.0r4.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r1.0:*:*:*:*:*:*:* Versions 9.1r1.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r2.0:*:*:*:*:*:*:* Versions 9.1r2.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r3.0:*:*:*:*:*:*:* Versions 9.1r3.0 Vulnerable ·Pulse Secure
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r3.1:*:*:*:*:*:*:*9.1r3.1VulnerablePulse Secure
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r3.1:*:*:*:*:*:*:* Versions 9.1r3.1 Vulnerable ·Pulse Secure
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8956
  2. 2026-10-03 Alias added: GHSA-rw4x-mrcc-6rwp

References

Advisory 1

  • TI-2016-02163 Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and… CVSS 3.0HIGH 7.8
  • TI-2018-05477 Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN… CVSS 3.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences