Critical severity · published May 26, 2016
CVE-2016-4787
Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in…
10.0
CVSS
2.5%
EPSS
No
On KEV
Description
Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Connect Secure · Ivanti
8.0; 8.2; 8.1 · source: NVD
PC
Pulse Connect Secure · Pulsesecure
7.4; 8.1r1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4787
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4787
www.securitytracker.com
http://www.securitytracker.com/id/1035932
Vendor Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40207
More from Connect Secure
10.0
CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
10.0
CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
9.8
CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
9.1
CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
9.0
CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability