CVE-2026-92860: rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation
A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. The attack may be performed from remote. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcourtman Pulse Quick Security Setup (quick-setup)to a version that resolves this vulnerability.Fixed in 6.0.4/6.1.0-rc.4
Event History
Frequently Asked Questions
Which deployments are affected?
rcourtman Pulse versions up to 6.0.4 and 6.1.0-rc.4 are identified as affected. The issue is in the Quick Security Setup Handler at /api/security/quick-setup.
What access does an attacker need?
The attack can be performed remotely and has low attack complexity. The supplied severity vector indicates that the attacker needs high privileges, and no user interaction is required.
What input is involved in exploitation?
Exploitation involves manipulating the Username argument passed to fmt.Sprintf in the Quick Security Setup Handler. The reported weakness is improper input validation.
What should teams do?
Upgrade the affected component, as advised in the vulnerability information. The provided data does not identify a specific fixed version or an alternative mitigation.