CVE-2018-9849

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-10 · updated 2026-06-17

Description

Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document.

Affected products

Ivanti Connect Secure (Pulse Secure): from 8.1 before 8.1r14; from 8.2 before 8.2r11; from 8.3 before 8.3r5 — fixed in 8.1r14, 8.2r11, 8.3r5

How to fix

Upgrade to a fixed version: Ivanti Connect Secure (Pulse Secure) 8.1r14, 8.2r11, 8.3r5. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/104160
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730
http://www.securityfocus.com/bid/104160
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730

Get alerted when CVE-2018-9849 or the next vulnerability affects your stack