A critical improper input validation vulnerability (CVSS 9.1) in rcourtman Pulse allows remote attackers with high privileges to abuse the Quick Security Setup handler, with impact crossing the security scope boundary into connected components.
What Is It
CVE-2026-92860 is an improper input validation flaw (CWE-20) in rcourtman Pulse versions up to 6.0.4 and 6.1.0-rc.4. The issue sits in the fmt.Sprintf call within /api/security/quick-setup, part of the Quick Security Setup Handler. Manipulation of the Username argument triggers the improper input validation condition. The attack can be performed remotely.
The CNA ([email protected]) assigns a CVSS 3.1 base score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, alongside a CVSS 4.0 score of 9.4 (CRITICAL) and a CVSS 2.0 score of 8.3. The record was published 2026-09-17 and currently sits in Received status; NVD has not completed its own analysis, so every score and affected-version detail below reflects the CNA submission rather than an independent NVD assessment.
Why It Matters
The scope is marked Changed (S:C) with high confidentiality, integrity, and availability impact on both the vulnerable component and downstream systems; meaning a successful attack does not stay contained within Pulse itself. Attack vector is network with low complexity and no user interaction required, so exploitation does not depend on tricking an operator.
The mitigating factor is PR:H, high privileges are required. The CVSS 2.0 vector further indicates multiple authentication instances (Au:M). This is not an unauthenticated internet-facing takeover, but it is a severe privilege-escalation and lateral-impact primitive for anyone who already holds elevated access to a Pulse deployment.
What's Vulnerable
Vendor: rcourtman. Product: Pulse. Component: Quick Security Setup Handler.
Reported affected versions (per the VulDB/NVD record): - 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4 - 6.1.0-rc.0, 6.1.0-rc.1, 6.1.0-rc.2, 6.1.0-rc.3, 6.1.0-rc.4
CPE: cpe:2.3:a:rcourtman:pulse:*:*:*:*:*:*:*:*
Patch Status
The advisory record advises upgrading the affected component. Pulse v6.1.0 is referenced as a release tag in the advisory references, and a GitHub Security Advisory (GHSA-rr3f-jjrr-3qxv) has been published by the project. No CISA KEV entry exists for this CVE, there is no confirmation of active exploitation in the supplied source material, and no federal required-action deadline applies.
Sources
- NVD, CVE-2026-92860: https://nvd.nist.gov/vuln/detail/CVE-2026-92860
- GitHub Security Advisory GHSA-rr3f-jjrr-3qxv: https://github.com/rcourtman/Pulse/security/advisories/GHSA-rr3f-jjrr-3qxv
- Pulse v6.1.0 Release: https://github.com/rcourtman/Pulse/releases/tag/v6.1.0
- rcourtman/Pulse Repository: https://github.com/rcourtman/Pulse/
- VulDB, CVE-2026-92860: https://vuldb.com/cve/CVE-2026-92860
- VulDB Entry 406309: https://vuldb.com/vuln/406309