Is CVE-2020-12880 being actively exploited?

CVE-2020-12880 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2020-12880?

CVE-2020-12880 has a CVSS 3.1 base score of 5.5 (MEDIUM).

CVE-2020-12880

MEDIUM · CVSS 5.5EPSS 0.5%EU EUVD

An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and can be retrieved. (The source code is otherwise inaccessible because the appliance has its hard disks encrypted, and no root shell is available during normal operation.)

Key facts

CVSS score: 5.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS score: 0.5% (40th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2020-5161)
Published: July 27, 2020
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2020-5161 in the EU Vulnerability Database. Last updated in EUVD on August 4, 2024.

View on the EU Vulnerability Database

Affected products

ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / connect secure
ivanti / policy secure
ivanti / policy secure
ivanti / policy secure
ivanti / policy secure
ivanti / policy secure
ivanti / policy secure
ivanti / policy secure
ivanti / policy secure
ivanti / policy secure
ivanti / policy secure
pulsesecure / pulse connect secure
pulsesecure / pulse policy secure

Certified products that may be affected

3 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Pulse Connect Secure 8.2 on Virtual Appliance and Pulse Policy Secure 5.3 on Virtual Appliance - Pulse Secure, LLC - Common Criteria CCEVS-VR-VID-10829-2018 - archived
Pulse Policy Secure v5.3 - Pulse Secure, LLC - Common Criteria CCEVS-VR-VID-10785-2017 - archived
Pulse Policy Secure 5.0 R13 - Pulse Secure, LLC - Common Criteria Certificate Number: 2016/98 - archived

References

https://kb.pulsesecure.net/?atype=sa(Vendor Advisory)
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain