CVE-2016-4789: Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user int...

Security readout for executives and security teams

CVE-2016-4789 is a cross-site scripting issue in the administrative system configuration area of Pulse Connect Secure. If exploited, an attacker could inject script or HTML into the admin interface. The public bundle does not provide CVSS scoring, detailed vectors, or evidence of active exploitation. Exposure is likely limited to organizations running the listed Pulse Connect Secure versions, especially where administrative access paths are reachable by untrusted networks or broad internal audiences. Treat this as a moderate-priority legacy appliance risk. Patch or replace affected PCS systems, especially if the admin interface is broadly reachable. Mitigation focus: Upgrade PCS to the fixed release for the deployed branch or later.; Review Pulse Secure advisory SA40209 for vendor-specific remediation guidance.; Restrict administrative UI access to trusted management networks and administrators..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.