UpHeron
All vulnerabilities

Servers and applications

CVE-2019-11510

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021.

Severity
Critical 10.0
Published
8 May 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
100% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Ivanti Connect SecureServers and applications · cpe:a:ivanti:connect_secure
  • Version 9.0-r3.3
  • Version 9.0-r3.2
  • Version 9.0-r3.1
  • Version 9.0-r3
All 37 release lines
  • Version 8.2-r1.0
  • Version 8.2-r1.1
  • Version 8.2-r2.0
  • Version 8.2-r3.0
  • Version 8.2-r3.1
  • Version 8.2-r4.0
  • Version 8.2-r4.1
  • Version 8.2-r5.0
  • Version 8.2-r5.1
  • Version 8.2-r6.0
  • Version 8.2-r7.0
  • Version 8.2-r7.1
  • Version 8.2-r8.0
  • Version 8.2-r8.1
  • Version 8.2-r8.2
  • Version 8.2-r9.0
  • Version 8.2-r10.0
  • Version 8.2-r11.0
  • Version 8.2-r12.0
  • Version 8.3-r1
  • Version 8.3-r2
  • Version 8.3-r2.1
  • Version 8.3-r3
  • Version 8.3-r4
  • Version 8.3-r5
  • Version 8.3-r5.1
  • Version 8.3-r5.2
  • Version 8.3-r6
  • Version 8.3-r6.1
  • Version 8.3-r7
  • Version 9.0-r1
  • Version 9.0-r2
  • Version 9.0-r2.1
  • Version 9.0-r3
  • Version 9.0-r3.1
  • Version 9.0-r3.2
  • Version 9.0-r3.3

Known exploited

CISA name
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
3 May 2022
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-11510
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-11510