Back to Database
Status published
Unknown
CVE-2020-13162
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client...
Vulnerability Description
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-13162
Credits & Attribution
No credits recorded in the NVD database.
References
- https://kb.pulsesecure.net/?atype=sa
- https://twitter.com/sepcali/status/1262551597990711296
- http://seclists.org/fulldisclosure/2020/Jun/25
- https://www.redtimmy.com/privilege-escalation/pulse-secure-client-for-windows-9-1-6-toctou-privilege-escalation-cve-2020-13162/
- http://packetstormsecurity.com/files/158117/Pulse-Secure-Client-For-Windows-Local-Privilege-Escalation.html
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44503
- https://twitter.com/gsepcali/status/1262551597990711296
- https://twitter.com/gsepcali/status/1272927080909623297
- http://seclists.org/fulldisclosure/2020/Sep/15
- http://packetstormsecurity.com/files/159065/Pulse-Secure-Windows-Client-Privilege-Escalation.html
More from pulsesecure
View All →CVE-2021-31922
An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic...
High
7.5
CVE-2020-8956
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before...
Low
3.8
CVE-2020-15408
An issue was discovered in Pulse Secure Pulse Connect Secure...
Low
3.7
CVE-2020-11582
An issue was discovered in Pulse Secure Pulse Connect Secure...
High
8.8
CVE-2020-11581
An issue was discovered in Pulse Secure Pulse Connect Secure...
High
8.1
Affected Vendor
pulsesecure
View all reports →Affected Software
pulse secure desktop client, pulse secure installer service
Vulnerable Versions:
5.3, 9.0, 9.1, 8.3
Timeline
Official Publish:
June 16th, 2020
Last Modified:
May 5th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.