{"id":"CVE-2019-11510","aliases":["EUVD-2019-3183","GHSA-6wr2-qx99-98mg"],"status":"published","title":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7...","description":"In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .","severity":{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.99999,"percentile":0.99995,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2019-05-08T16:18:28Z","modified":"2026-06-17T02:13:04Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"exploitdb","id":"EDB-47297","title":"Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - Arbitrary File Disclosure (Metasploit)","type":"webapps","platform":"multiple","date":"2019-08-21","url":"https://www.exploit-db.com/exploits/47297"},{"source":"pocgithub","id":"nuc13us/Pulse","title":"nuc13us/Pulse","date":"2019-08-21","url":"https://github.com/nuc13us/Pulse"},{"source":"pocgithub","id":"projectzeroindia/CVE-2019-11510","title":"projectzeroindia/CVE-2019-11510","date":"2019-08-21","url":"https://github.com/projectzeroindia/CVE-2019-11510"},{"source":"pocgithub","id":"imjdl/CVE-2019-11510-poc","title":"imjdl/CVE-2019-11510-poc","date":"2019-08-22","url":"https://github.com/imjdl/CVE-2019-11510-poc"},{"source":"pocgithub","id":"es0/CVE-2019-11510_poc","title":"es0/CVE-2019-11510_poc","date":"2019-08-26","url":"https://github.com/es0/CVE-2019-11510_poc"},{"source":"pocgithub","id":"jas502n/CVE-2019-11510-1","title":"jas502n/CVE-2019-11510-1","date":"2019-08-27","url":"https://github.com/jas502n/CVE-2019-11510-1"},{"source":"pocgithub","id":"r00tpgp/http-pulse_ssl_vpn.nse","title":"r00tpgp/http-pulse_ssl_vpn.nse","date":"2019-08-27","url":"https://github.com/r00tpgp/http-pulse_ssl_vpn.nse"},{"source":"pocgithub","id":"jason3e7/CVE-2019-11510","title":"jason3e7/CVE-2019-11510","date":"2019-08-29","url":"https://github.com/jason3e7/CVE-2019-11510"},{"source":"pocgithub","id":"BishopFox/pwn-pulse","title":"BishopFox/pwn-pulse","date":"2019-09-09","url":"https://github.com/BishopFox/pwn-pulse"},{"source":"pocgithub","id":"aqhmal/pulsexploit","title":"aqhmal/pulsexploit","date":"2019-12-07","url":"https://github.com/aqhmal/pulsexploit"},{"source":"pocgithub","id":"cisagov/check-your-pulse","title":"cisagov/check-your-pulse","date":"2020-04-16","url":"https://github.com/cisagov/check-your-pulse"},{"source":"pocgithub","id":"andripwn/pulse-exploit","title":"andripwn/pulse-exploit","date":"2020-07-27","url":"https://github.com/andripwn/pulse-exploit"},{"source":"pocgithub","id":"pwn3z/CVE-2019-11510-PulseVPN","title":"pwn3z/CVE-2019-11510-PulseVPN","date":"2020-09-17","url":"https://github.com/pwn3z/CVE-2019-11510-PulseVPN"},{"source":"pocgithub","id":"34zY/APT-Backpack","title":"34zY/APT-Backpack","date":"2022-12-13","url":"https://github.com/34zY/APT-Backpack"},{"source":"metasploit","id":"auxiliary/gather/pulse_secure_file_disclosure","title":"Pulse Secure VPN Arbitrary File Disclosure","type":"auxiliary","date":"2019-04-24","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/pulse_secure_file_disclosure"},{"source":"nuclei","id":"CVE-2019-11510","title":"Pulse Connect Secure SSL VPN Arbitrary File Read","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11510.yaml"}],"products":[{"vendor":"ivanti","product":"connect_secure"},{"vendor":"ivanti","product":"pulse connect secure"}],"references":[{"url":"https://kb.pulsesecure.net/?atype=sa","tags":["x_refsource_MISC","x_transferred","Not Applicable","Vendor Advisory"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/108073","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a%40%3Cuser.guacamole.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List"]},{"url":"https://www.kb.cert.org/vuls/id/927237","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11510","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11510"},{"url":"https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a@%3Cuser.guacamole.apache.org%3E"},{"url":"https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510"},{"url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study"},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101"},{"url":"https://github.com/advisories/GHSA-6wr2-qx99-98mg"}],"sources":{"cve":[{"id":"CVE-2019-11510","description":"In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .","status":"published","published":"2019-05-08T16:18:28Z","modified":"2025-10-21T23:45:37.755Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-3183","description":"In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .","status":"published","published":"2019-05-08T16:18:28Z","modified":"2025-10-21T23:45:37Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-6wr2-qx99-98mg","title":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7...","description":"In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker can upload a malicious file to write to arbitrary files, because of Insecure Permissions.","status":"published","published":"2022-05-24T16:45:20Z","modified":"2025-10-22T00:31:40Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2019-11510","title":"Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","description":"Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.","cwes":["CWE-22"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2019-11510","description":"In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .","status":"published","published":"2019-05-08T17:29:00.63Z","modified":"2026-06-17T02:13:04.277Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:13.880207Z"}]}}