CVE-2019-11510
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitra...
Affects 1 product across 1 vendor.
Attacker manipulates file path inputs to access files outside the intended directory.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2019-11510 affects Pulse Secure Pulse Connect Secure (PCS) versions 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files, leading to a complete compromise of the system. The CVSS score is 10.0, indicating critical severity, and the vulnerability has a public proof-of-concept and known exploits. Immediate action is required to mitigate the risk.
BSID: BS-2019-GLOBAL-230918-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2019-11510?
What is the CVSS score for CVE-2019-11510?
Is CVE-2019-11510 actively exploited?
How do I remediate CVE-2019-11510?
What systems are affected by CVE-2019-11510?
What NERC-CIP standard applies to CVE-2019-11510?
What IEC 62443 requirement maps to CVE-2019-11510?
| CVE ID | CVE-2019-11510 |
|---|---|
| BSID | BS-2019-GLOBAL-230918-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2019-05-08 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
Source: NIST NVD / MITRE CVE Database
The vulnerability allows an unauthenticated remote attacker to send a specially crafted URI to the affected Pulse Connect Secure (PCS) appliance, which can result in the reading of arbitrary files. This can lead to the disclosure of sensitive information, including configuration files and credentials, potentially allowing further exploitation and full system compromise.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Ivanti | Connect Secure | 8.2 8.3 9.0 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | ● Active Exploitation Confirmed (added 2021-11-03) |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
Implement strict network segmentation and access controls to limit exposure of the Pulse Connect Secure (PCS) appliance to untrusted networks. Regularly monitor logs for suspicious activity and apply the latest security patches as soon as they become available.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to the control center, which could compromise the security of the electronic security perimeter.
This CVE maps to SR 7.6 because it involves a vulnerability that allows unauthorized access to the system, which can lead to the disclosure of sensitive information and potential further exploitation.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 8eaade1fb0ac3464977d7fc95e3da944cab98c6539be794fbc4e4fc7a377aef66e183e7baa1837f423b72c09543e39a3291be54042d0121ca9da97a92fd5df4a |
This Vulnerability Is Being Actively Exploited
CVE-2019-11510 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →