Cyber & AI intelligence
Wasteland.
Briefs indexed2691
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-92860 2026-09-17

CVE-2026-92860: Critical Input Validation Flaw in rcourtman Pulse Quick Security Setup

"A critical improper input validation vulnerability (CVSS 9.1) in rcourtman Pulse allows remote attackers with high privileges to abuse the Quick Security Setup handler, with impact crossing the security scope boundary…"

A critical improper input validation vulnerability (CVSS 9.1) in rcourtman Pulse allows remote attackers with high privileges to abuse the Quick Security Setup handler, with impact crossing the security scope boundary into connected components.

What Is It

CVE-2026-92860 is an improper input validation flaw (CWE-20) in rcourtman Pulse versions up to 6.0.4 and 6.1.0-rc.4. The issue sits in the fmt.Sprintf call within /api/security/quick-setup, part of the Quick Security Setup Handler. Manipulation of the Username argument triggers the improper input validation condition. The attack can be performed remotely.

The CNA ([email protected]) assigns a CVSS 3.1 base score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, alongside a CVSS 4.0 score of 9.4 (CRITICAL) and a CVSS 2.0 score of 8.3. The record was published 2026-09-17 and currently sits in Received status; NVD has not completed its own analysis, so every score and affected-version detail below reflects the CNA submission rather than an independent NVD assessment.

Why It Matters

The scope is marked Changed (S:C) with high confidentiality, integrity, and availability impact on both the vulnerable component and downstream systems; meaning a successful attack does not stay contained within Pulse itself. Attack vector is network with low complexity and no user interaction required, so exploitation does not depend on tricking an operator.

The mitigating factor is PR:H, high privileges are required. The CVSS 2.0 vector further indicates multiple authentication instances (Au:M). This is not an unauthenticated internet-facing takeover, but it is a severe privilege-escalation and lateral-impact primitive for anyone who already holds elevated access to a Pulse deployment.

What's Vulnerable

Vendor: rcourtman. Product: Pulse. Component: Quick Security Setup Handler.

Reported affected versions (per the VulDB/NVD record): - 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4 - 6.1.0-rc.0, 6.1.0-rc.1, 6.1.0-rc.2, 6.1.0-rc.3, 6.1.0-rc.4

CPE: cpe:2.3:a:rcourtman:pulse:*:*:*:*:*:*:*:*

Patch Status

The advisory record advises upgrading the affected component. Pulse v6.1.0 is referenced as a release tag in the advisory references, and a GitHub Security Advisory (GHSA-rr3f-jjrr-3qxv) has been published by the project. No CISA KEV entry exists for this CVE, there is no confirmation of active exploitation in the supplied source material, and no federal required-action deadline applies.

Sources