← Vulnerability Intelligence

CVE-2019-11539

High 7.2 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

Metrics

CVSS 3.1
7.2 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
99% (percentile: 100) as of 2 November 2026
CWE
CWE-78

Affected products

ivanti: connect secure; ivanti: policy secure; pulsesecure: pulse policy secure

References