{"id":"CVE-2019-11509","aliases":["EUVD-2019-3182","GHSA-f2cx-w4q6-4qq4"],"status":"published","title":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7...","description":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07676,"percentile":0.94631,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-06-03T19:34:46Z","modified":"2026-06-17T02:13:04Z","products":[{"vendor":"ivanti","product":"connect_secure"},{"vendor":"ivanti","product":"policy_secure"},{"vendor":"pulsesecure","product":"pulse_policy_secure"}],"references":[{"url":"https://kb.pulsesecure.net/?atype=sa","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/927237","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11509"},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101"},{"url":"https://github.com/advisories/GHSA-f2cx-w4q6-4qq4"}],"sources":{"cve":[{"id":"CVE-2019-11509","description":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.","status":"published","published":"2019-06-03T19:34:46Z","modified":"2024-08-04T22:55:40.698Z","updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-3182","description":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.","status":"published","published":"2019-06-03T19:34:46Z","modified":"2024-08-04T22:55:40Z","updated_at":"2026-11-03T02:40:48.932719Z"}],"ghsa":[{"id":"GHSA-f2cx-w4q6-4qq4","title":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7...","description":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.","status":"published","published":"2022-05-24T16:47:00Z","modified":"2024-03-07T05:10:04Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:55:38.886845Z"}],"nvd":[{"id":"CVE-2019-11509","description":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.","status":"published","published":"2019-06-03T20:29:00.517Z","modified":"2026-06-17T02:13:04.127Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:14.729983Z"}]}}