High severity · published Apr 26, 2019
CVE-2019-11539
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
RansomwareIn wildKEV
7.2
CVSS
98.5%
EPSS
Yes
On KEV
Description
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)98.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useKnown
Affected products
Which versions
CS
Connect Secure · Ivanti
8.1; 8.1; 8.1; 8.1; 8.1; 8.1; +34 more · source: NVD
PS
Policy Secure · Ivanti
9.0; 9.0; 9.0; 9.0; 9.0 · source: NVD
PP
Pulse Policy Secure · Pulsesecure
5.1r1.0; 5.1r1.1; 5.1r2.0; 5.1r2.1; 5.1r3.0; 5.1r3.2; +34 more · source: NVD
PC
Pulse Connect Secure and Pulse Policy Secure · Ivanti
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11539
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101
vdb-entry
http://www.securityfocus.com/bid/108073
x_refsource_CONFIRM
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
x_refsource_MISC
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf
x_refsource_MISC
http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html
x_refsource_MISC
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/
More from Connect Secure
10.0
CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
10.0
CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
9.8
CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
9.1
CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
9.0
CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability