CVE-2018-5299

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-16 · updated 2026-06-17
Weakness: CWE-787

Description

A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4, leading to memory corruption and possibly remote code execution.

Affected products

Ivanti Connect Secure (Pulse Secure): from 8.3r1 through 8.3r3
Pulsesecure Pulse Policy Secure: from 5.4r1 through 5.4r3

References

http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43604
http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43604

Get alerted when CVE-2018-5299 or the next vulnerability affects your stack