CVE-2018-14366

MEDIUM

download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability.

Affects 3 products across 2 vendors.

CVSS 3.06.1
EPSS1.5%
Percentile73th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, can impact systems beyond the vulnerable component, no availability impact.
CWE Weakness Definitions
CWE-601: CWE-601
Related Attack Patterns (CAPEC)
CAPEC-178 Cross-Site Flashing
via CWE-601

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A medium severity vulnerability affects Ivanti systems (CVE-2018-14366). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-219700-M • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-14366?
This vulnerability was disclosed in 2018. A medium severity vulnerability affects Ivanti systems (CVE-2018-14366). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-14366?
CVE-2018-14366 has CVSS 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS: 1.5%.
Is CVE-2018-14366 actively exploited?
No confirmed active exploitation of CVE-2018-14366 as of 2026-05-30.
How do I remediate CVE-2018-14366?
Priority: MONITOR. PSIRT: [email protected]
What systems are affected by CVE-2018-14366?
CVE-2018-14366 affects Ivanti Connect Secure; Pulsesecure Pulse Connect Secure, Pulse Policy Secure.
Vulnerability Details
CVE IDCVE-2018-14366
BSIDBS-2018-GLOBAL-219700-M BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published2018-09-06
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
CWE-601
SourceNVD
Official Description

download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: download.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and Pulse Policy Secure through 5.2RX before 5.2R10 and 5.4RX before 5.4R4 have an Open Redirect Vulnerability. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Ivanti Connect Secure 8.1 8.3
Pulsesecure Pulse Connect Secure 8.1r1.0 8.1rx 8.3rx
Pulsesecure Pulse Policy Secure 5.2r1.0 5.2r2.0 5.2r3.0 5.2r3.2 5.2r4.0 5.2r5.0
+12 more5.2r6.0 5.2r7.0 5.2r7.1 5.2r8.0 5.2r9.0 5.2r9.1 5.2rx 5.4r1 5.4r2 5.4r2.1 5.4r3 5.4rx
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2961 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash8a32f634f747831721bcd1b370f642c8440431355b0153f3a54beb181281a8e2f3c03537737aaad80dd02d71bc482fdc4c11d4c164b80d859a2d8961c2717853
Related CVEs affecting Ivanti
CVE-2026-10520 10.0 An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R1... CVE-2021-22893 10.0 Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authenticatio... CVE-2016-4787 10.0 Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0... CVE-2019-11510 10.0 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.... CVE-2020-13774 9.9 An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpo...
View all Ivanti CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →