How severe is CVE-2018-11002?

CVE-2018-11002 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2018-11002 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-11002?

CVE-2018-11002 primarily affects Pulsesecure Pulse Secure Desktop Client. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-11002?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-11002 published?

CVE-2018-11002 was published on 2018-11-29 and last updated on 2026-06-17.

CVE-2018-11002

CVE-2018-11002 is a medium-severity vulnerability in Pulsesecure Pulse Secure Desktop Client with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-732.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 5.8
EPSS exploit prediction: 1% (55th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-732
Affected product: Pulsesecure Pulse Secure Desktop Client
Published: 2018-11-29
Last modified: 2026-06-17

Description

Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions.

Frequently asked questions

What is CVE-2018-11002?: Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions.
How severe is CVE-2018-11002?: CVE-2018-11002 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2018-11002 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-11002?: CVE-2018-11002 primarily affects Pulsesecure Pulse Secure Desktop Client. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-11002?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-11002 published?: CVE-2018-11002 was published on 2018-11-29 and last updated on 2026-06-17.

References

Affected products (10)

cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r1:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r1.1:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r2:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r3:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r4:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r4.1:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r4.2:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r5:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r5.2:*:*:*:*:windows:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3r6:*:*:*:*:windows:*:*

More vulnerabilities in Pulsesecure Pulse Secure Desktop Client

CVE-2020-8239 — Critical (CVSS 9.8): A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation…
CVE-2020-8254 — High (CVSS 8.8): A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to…
CVE-2019-11213 — High (CVSS 8.1): In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof…
CVE-2020-8250 — High (CVSS 7.8): A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
CVE-2020-8249 — High (CVSS 7.8): A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer…
CVE-2020-8248 — High (CVSS 7.8): A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.

All CVEs affecting Pulsesecure Pulse Secure Desktop Client →

Other CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities

CVE-2026-9508 — Critical (CVSS 10.0): Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow…
CVE-2025-14988 — Critical (CVSS 10.0): A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain…
CVE-2025-69426 — Critical (CVSS 10.0): The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating…
CVE-2025-12004 — Critical (CVSS 10.0): Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown…
CVE-2014-125121 — Critical (CVSS 10.0): Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation…
CVE-2025-46093 — Critical (CVSS 9.9): LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to…

Browse all CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities →