How severe is CVE-2020-8956?

CVE-2020-8956 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2020-8956 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (64th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-8956?

CVE-2020-8956 primarily affects Pulsesecure Pulse Secure Desktop. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-8956?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-8956 published?

CVE-2020-8956 was published on 2020-10-27 and last updated on 2026-06-17.

CVE-2020-8956

CVE-2020-8956 is a low-severity vulnerability in Pulsesecure Pulse Secure Desktop with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-521.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
CVSS v2: 1.9
EPSS exploit prediction: 1% (64th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-521
Affected product: Pulsesecure Pulse Secure Desktop
Published: 2020-10-27
Last modified: 2026-06-17

Description

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.

Frequently asked questions

What is CVE-2020-8956?: Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
How severe is CVE-2020-8956?: CVE-2020-8956 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2020-8956 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (64th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-8956?: CVE-2020-8956 primarily affects Pulsesecure Pulse Secure Desktop. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-8956?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-8956 published?: CVE-2020-8956 was published on 2020-10-27 and last updated on 2026-06-17.

References

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601

Affected products (11)

cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r1.0:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r2.0:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r2.1:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r3.0:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r3.1:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r4.0:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.0r4.1:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r1.0:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r2.0:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r3.0:*:*:*:*:*:*:*
cpe:2.3:a:pulsesecure:pulse_secure_desktop:9.1r3.1:*:*:*:*:*:*:*

More vulnerabilities in Pulsesecure Pulse Secure Desktop

CVE-2016-2408 — High (CVSS 7.8): Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow…
CVE-2018-7572 — Medium (CVSS 6.8): Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can…

All CVEs affecting Pulsesecure Pulse Secure Desktop →

Other CWE-521 (Weak Password Requirements) vulnerabilities

CVE-2026-25715 — Critical (CVSS 9.8): The web management interface of the device allows the administrator username and password to be set to blank values.…
CVE-2025-53963 — Critical (CVSS 9.8): An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible…
CVE-2025-63747 — Critical (CVSS 9.8): QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit…
CVE-2025-12552 — Critical (CVSS 9.8): Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11200 — Critical (CVSS 9.8): MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to…
CVE-2025-12364 — Critical (CVSS 9.8): Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Browse all CWE-521 (Weak Password Requirements) vulnerabilities →