CriticalCVE-2019-11510

    Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability (CVE-2019-11510)

    Published In CISA KEV since Sources: CVE.org, SingCERT

    Share

    What is affected, what to do

    The vulnerability CVE-2019-11510 allows an unauthenticated remote attacker to read arbitrary files by sending a specially crafted URI, potentially leading to remote code execution (RCE). It affects various versions of Ivanti Pulse Connect Secure, including 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. This vulnerability is actively exploited in ransomware campaigns, highlighting the urgency of mitigation. Organizations should verify their systems for affected versions and promptly apply the recommended patches to close the security gap.

    The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Ivanti Connect Secure eq 8.2..8.2
    • Ivanti Connect Secure eq 8.3..8.3
    • Ivanti Connect Secure eq 9.0..9.0

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    10.0

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.9

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: CVE.org, SingCERT

    —

    EPSS score

    No value is available for this vulnerability.

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    254.50 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    10.0 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.9
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 3 February 2025
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-22

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This CVE sits among the most aggressively exploited edge-device bugs of recent years and is on KEV because it is unauthenticated, network-reachable and trivially weaponised — a single HTTPS request reads arbitrary files including cleartext credentials and session cookies. CISA explicitly flags it for ransomware use; multiple groups have chained it as initial access for network-wide encryption and data theft, with heavy targeting of healthcare, government and manufacturing. For a NIS2-regulated organisation running an exposed Pulse Connect Secure, treat this as a P1 incident regardless of current patch state — any appliance not yet patched AND forensically cleaned must be assumed compromised, because stolen credentials persist long after the vulnerability itself is closed.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Upgrade Pulse Connect Secure appliances to a fixed release immediately: PCS 8.2R12.1, 8.3R7.1 or 9.0R3.4 (or any later Ivanti build). Apply vendor advisory SA44101 — this is mandatory, no workaround substitutes for the patch.
      • After patching, reset ALL local admin and user accounts on the PCS, including AD service accounts that authenticate through the appliance. Rotate session cookies, pre-shared keys and API tokens as well — the bug leaks /etc/passwd-equivalent paths and active session data.
      • Enforce or verify MFA on every VPN account; harvested credentials without a second factor are the primary follow-on vector for this CVE.
      • Until the patch is verified in place, restrict external HTTPS (TCP/443) to the appliance at the perimeter firewall to known admin source IPs, or block it outright.
      • Perform forensics BEFORE rebooting: capture a memory and config snapshot, then hunt for the IOCs published in CISA AA20-010A and AA21-110A (webshells under /dana/, modified Perl/CGI files, rogue SSH keys).
      • If compromise is suspected: pull the appliance offline, factory-reset, reinstall from a signed Ivanti image, THEN patch before returning it to service.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: place the PCS in a dedicated DMZ with no outbound internet access except Ivanti update endpoints; restrict internal zones reachable from VPN-terminated sessions to the minimum necessary ports and hosts.
      • WAF or reverse proxy in front of the PCS with a deny rule on path-traversal patterns in the URI — specifically requests to /dana-na/ containing "../", "%2e%2e" or references to /dana/html5acc/guacamole/ outside the normal auth flow.
      • Enable IPS signatures: Snort SIDs 50458-50460 and the equivalent Suricata rules for CVE-2019-11510, triggering on GET requests containing "/dana-na/../dana/html5acc/guacamole/" and similar traversal payloads.
      • Forward logging centrally: ship PCS syslog to the SIEM, export the config daily and diff it against a known-good baseline. Local logs on the appliance are reachable and removable by an attacker who exploits this bug.
      • IAM hardening: admin access to the PCS only via a jump host with MFA, no direct browser sessions from the general office LAN. LDAP/RADIUS bind accounts limited to read-only, never a Domain Admin equivalent.
      • Vulnerability monitoring: subscribe to the Ivanti advisory feed and set a 48 h patch SLA for edge appliances, with NIS2-compliant documentation of the risk decision.

    3. Runbook step 3

      Detection rules

      • PCS web access log: hunt GET requests containing "/dana-na/../dana/", "/+CSCOE+/", "?/dana/html5acc/guacamole/" and URL-encoded traversal ("%2e%2e%2f"). KQL shape: W3CIISLog | where csUriStem contains "dana-na" and csUriQuery contains "../".
      • Zeek/Suricata: HTTP requests to PCS IPs with URI length > 200 chars and unusually large response bodies on unauthenticated GETs — a signature of successful arbitrary file read.
      • Filesystem monitoring (where root/debug shell is available): new or modified files under /home/runtime/mtmp/, /data/runtime/mtmp/lmdb/, suspicious Perl scripts in /home/perl/.
      • Authentication anomalies in the SIEM: successful VPN logons from geolocations or at times outside the user's baseline; logons that follow known scanning patterns on the same source IP. Sigma shape: detection.selection.EventID: 'VPN-LOGIN-SUCCESS' AND user.geolocation NOT IN baseline.
      • Network telemetry: outbound connections from the PCS to non-Ivanti IPs on ports 443, 4444 or 8443 — the appliance should only initiate traffic to Ivanti update infrastructure.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

    Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CSA/SingCERT

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    ivanticonnect_secure
    • 8.2
    • 9.0
    • 8.3
    • —
    • —
    • —

    Vendors and products

    Weakness classes (CWE)

    • CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

      Base

      The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

      Entry at MITRE CWE-22

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    Packet StormPulse Secure SSL VPN 8.1R15.1 8.2 8.3 9.0 Arbitrary File Disclosure (opens in a new tab)packetstormsecurity.comPoC (publicly reported)reported, not verified—
    Packet StormPulse Secure SSL VPN File Disclosure NSE (opens in a new tab)packetstormsecurity.comPoC (publicly reported)reported, not verified—

    References & sources

    • kb.pulsesecure.net?atype=sax_refsource_MISC, Not applicable, Vendor advisory
    • kb.pulsesecure.netarticles/Pulse_Security_Advisories/SA44101x_refsource_CONFIRM, Broken link, Patch, Vendor advisory
    • securityfocus.com108073Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
    • psirt.global.sonicwall.comvuln-detail/SNWLID-2019-0010x_refsource_CONFIRM, Third-party advisory
    • packetstormsecurity.comfiles/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrar…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
    • badpackets.netover-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11…x_refsource_MISC, Broken link, Third-party advisory
    • packetstormsecurity.comfiles/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.htmlx_refsource_MISC, Third-party advisory, Vulnerability database
    • i.blackhat.comUSA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Lik…x_refsource_MISC, Third-party advisory
    • devco.reblog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secur…x_refsource_MISC, Exploit, Third-party advisory
    • lists.apache.org[guacamole-user] 20190912 Re: [Guacamole hack attack?]Mailing list, x_refsource_MLIST, Mailing list
    • kb.cert.orgVU#927237Third-party advisory, x_refsource_CERT-VN, Third-party advisory, US government resource
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11510government-resource, US government resource
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2019-11510
    <a href="https://intel.neosec.eu/en/cve/CVE-2019-11510"><img src="https://intel.neosec.eu/badge/cve/CVE-2019-11510.svg?lang=en" alt="CVE-2019-11510 – NEOSEC Intel" height="20"></a>