CVE-2020-8956
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users'...
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
- Record
CVE-2020-8956- CVSS 3.0
- 3.8 Low
CVSS:3.0/AC:L/AV:L/A:N/C:L/I:N/PR:L/S:C/UI:N - Updated
- 2026-11-02
EUVDEUVD-2020-29786
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
- Record
EUVD-2020-29786- CVSS 3.0
- 3.8 Low
CVSS:3.0/AC:L/AV:L/A:N/C:L/I:N/PR:L/S:C/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rw4x-mrcc-6rwp No score
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users'...
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
- Record
GHSA-rw4x-mrcc-6rwp- Weakness
- CWE-521
- Updated
- 2026-11-02
NVD
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
- Record
CVE-2020-8956- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-521
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Windows Pulse Secure Connect Client Saved Password Extractor |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8956 is a low vulnerability (CVSS 3.8) in Pulsesecure Pulse Secure Desktop, published October 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. No source names a fixed version.