CVE-2016-3985

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-12 · updated 2026-06-17
Weakness: CWE-284

Description

The Terminal Services Remote Desktop Protocol (RDP) client session restrictions feature in Pulse Connect Secure (aka PCS) 8.1R7 and 8.2R1 allow remote authenticated users to bypass intended access restrictions via unspecified vectors.

Affected products

Ivanti Connect Secure (Pulse Secure): 8.1r7, 8.2r1

References

http://www.securitytracker.com/id/1035129
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40166
http://www.securitytracker.com/id/1035129
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40166

Get alerted when CVE-2016-3985 or the next vulnerability affects your stack