CVE-2019-11510

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

Severity: critical
CVSS v3: 10
EPSS percentile: 100%
Known exploited: yes (CISA KEV)
Vendor: Ivanti
Product: Pulse Connect Secure
Published: 2021-11-03
Modified: 2026-06-17

Description

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

NVD record

Informational only. Not a warranty of security, completeness or fitness for any purpose. Derived from NVD, CISA KEV, FIRST.org EPSS and vendor advisories (CVE Program List v5); those sources change continuously and may be incomplete or incorrect. Verify every remediation against the vendor advisory before acting. Absence of a finding is not evidence that no vulnerability exists. Not endorsed by NVD, CISA, FIRST or any vendor named.

Raw record

{
  "id": "CVE-2019-11510",
  "title": "Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability",
  "description": "In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .",
  "severity": "critical",
  "cvss": 10,
  "epss": 100,
  "kev": 1,
  "vendor": "Ivanti",
  "product": "Pulse Connect Secure",
  "published": "2021-11-03",
  "modified": "2026-06-17T02:13:04.277",
  "source": "nvd",
  "remediation": [],
  "disclaimer": "Informational only. Not a warranty of security, completeness or fitness for any purpose. Derived from NVD, CISA KEV, FIRST.org EPSS and vendor advisories (CVE Program List v5); those sources change continuously and may be incomplete or incorrect. Verify every remediation against the vendor advisory before acting. Absence of a finding is not evidence that no vulnerability exists. Not endorsed by NVD, CISA, FIRST or any vendor named."
}