CVE-2019-11510
Critical 10.0 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
Metrics
- CVSS 3.1
-
10.0 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 2 November 2026
- CWE
- CWE-22
Affected products
ivanti: connect secure
References
- https://kb.pulsesecure.net/?atype=sa Not ApplicableVendor Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ Broken LinkPatchVendor Advisory
- https://kb.pulsesecure.net/?atype=sa Not ApplicableVendor Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ Broken LinkPatchVendor Advisory
- http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8… ExploitThird Party AdvisoryVDB Entry
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secu… ExploitThird Party Advisory
- http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8… ExploitThird Party AdvisoryVDB Entry
- https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secu… ExploitThird Party Advisory
- http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosur… Third Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/108073 Broken LinkThird Party AdvisoryVDB Entry