Yes. CISA added CVE-2020-8218 to its Known Exploited Vulnerabilities catalogue on 7 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
What it means to be exploited in the wild
CISA’s KEV inclusion is the practical signal that matters here: it reflects confirmed, active exploitation rather than a theoretical flaw. For defenders, that changes the question from “is this serious?” to “is any exposed Pulse Connect Secure instance still reachable, and has it already been touched?”
For a VPN appliance, exploitation usually matters because the device sits on a trust boundary. If an attacker can turn a web interface flaw into code execution, they may be able to pivot from initial access into session theft, credential capture, or deeper network access without needing a phishing chain first.
That is why KEV-listed edge-device issues are treated differently from routine bugs. The presence of active exploitation means exposure assessment, containment, and compromise checks all become time-sensitive, even before full remediation is complete.
How to confirm exposure and reduce blast radius
First determine whether the affected appliance is internet-facing, reachable from partner networks, or exposed through remote administration paths. A system that is technically vulnerable but isolated may still require action, but a publicly reachable remote-access gateway is the highest-priority case because it is the easiest to discover and abuse.
Then verify whether the vendor advisory and CISA Known Exploited Vulnerabilities Catalog say to patch, upgrade, or mitigate. For actively exploited VPN flaws, the safe default is to apply the vendor’s fix or compensating control as soon as operationally possible, rather than waiting for routine maintenance windows.
While that work is happening, reduce reachable surface area. Restrict admin access, remove unnecessary public exposure, tighten source IP allowlists where feasible, and place the appliance under the closest practical monitoring you can sustain. A compromised remote-access gateway is often valuable to attackers precisely because it gives them persistence near the front door.
What to check before and after remediation
Assume possible compromise if the appliance was exposed during the active-exploitation window. Check authentication logs, admin actions, unusual configuration changes, new local accounts, unexpected files, suspicious outbound connections, and signs that the box was used as a stepping stone to internal systems.
If the device handled VPN sessions, also review whether credentials, tokens, or active sessions could have been exposed. Where the appliance may have served as an entry point, rotating high-value credentials and invalidating active sessions is often necessary because patching alone does not undo stolen access.
Use authoritative vulnerability references for the exact remediation path. The NIST National Vulnerability Database helps with record confirmation, while the vendor advisory should drive the version and mitigation details. For this class of issue, the operational priority is not only fixing the bug, but proving the gateway was not already used as an access point.
Risk and Threat Considerations
The main risk is that a perimeter VPN or remote-access appliance is both exposed and trusted. When code execution is possible through the admin interface, an attacker can move from public reachability to privileged control of the gateway itself, which makes the flaw attractive for initial access and persistence.
Failure mechanism: A crafted request can trigger arbitrary code execution, which may let an attacker run commands, alter configuration, harvest credentials or sessions, and preserve access at the edge of the environment.
Impact: Compromise of a remote-access appliance can expose internal network paths, authenticated user sessions, and downstream systems that rely on the gateway’s trust boundary.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Networks and Services Are Monitored to Detect Potentially Adverse Events | Active exploitation of an exposed gateway requires monitoring for compromise signals. |
| RS.MA-01 — Incidents Are Managed | A KEV-listed actively exploited flaw needs coordinated containment and response actions. | |
| Recommendation — Monitor gateway logs and network traffic for signs of exploitation and post-access activity. Treat the exposed appliance as an incident candidate and execute containment and recovery steps. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This question is about a known exploited vulnerability requiring remediation or mitigation. |
| AC-17 — Remote Access | Pulse Connect Secure is a remote-access boundary that must be restricted during exploitation risk. | |
| Recommendation — Remediate or mitigate the vulnerable appliance immediately using vendor and CISA guidance. Restrict remote administrative access and narrow exposed entry points to the appliance. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation directly maps to prioritised vulnerability management and validation. |
| Recommendation — Prioritise, validate, and track remediation for the exposed VPN appliance. | ||
Practitioner Guidance
What to prioritise: Treat any internet-reachable Pulse Connect Secure instance as an emergency exposure review, not a routine vulnerability ticket. If the box cannot be patched immediately, focus first on containment, access restriction, and evidence preservation before deeper cleanup.
What to verify: Confirm whether the appliance was online during the exploitation window, whether admin access was exposed, and whether any indicators point to configuration tampering or post-exploitation activity. If you find uncertainty, assume the system deserves a compromise assessment, not just a patch.
Decision rule: If the gateway handled privileged remote access, rotate the credentials and invalidate the sessions most likely to have traversed it, especially for administrators and high-value users. The practical question is whether the device may have been trusted after an attacker could already execute code on it.
Practitioner takeaway: For KEV-listed VPN appliance flaws, the remediation objective is twofold: remove the vulnerability and prove the gateway was not already used as a foothold.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org