{"id":"CVE-2019-11539","published":"2019-04-26T02:29:00Z","modified":"2026-06-17T02:13:07Z","title":"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability","vendor":"Ivanti","product":"Pulse Connect Secure and Pulse Policy Secure","tier":"core","eol":null,"description":{"text":"In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.","provenance":"source","from":"NVD"},"summary":{"text":"Ivanti's Pulse Connect Secure and Pulse Policy Secure products contain a command injection flaw in their admin web interface, affecting specific pre-patch releases of each product. An attacker who has already authenticated over the network with high-privilege admin access can inject and execute operating system commands on the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:27Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98544,"percentile":0.99921,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11539","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-10-02","exploitedFirstSeen":"2019-10-02","ransomware":true,"evidence":[{"url":"https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities","date":"2019-10-02"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-259a","date":"2020-09-15"},{"url":"https://www.esentire.com/security-advisories/ransomware-groups-exploit-remote-access-services","date":"2020-09-17"},{"url":"https://cdn.pathfactory.com/assets/10753/contents/298161/03f15d14-01bb-462b-a8d4-d8c6149f5604.pdf","date":"2021-03-05"},{"url":"https://cybersecurityworks.com/patchwatch/patch-watch-csw-analysis-of-pulse-secure-vulnerabilities.html","date":"2021-05-21"},{"url":"https://www.hhs.gov/sites/default/files/revil-update-tlpwhite.pdf","date":"2021-08-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://cert-in.org.in/PDF/RANSOMWARE_Report_2022.pdf","date":"2023-04-22"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement","date":"2024-04-04"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/108073","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","tags":["Exploit","Third Party Advisory"]},{"url":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","tags":["Exploit","Third Party Advisory"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101","tags":["Third Party Advisory","Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/927237","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/108073","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","tags":["Exploit","Third Party Advisory"]},{"url":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","tags":["Exploit","Third Party Advisory"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101","tags":["Third Party Advisory","Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/927237","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires authenticated admin access via valid credentials","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"the admin web interface allows an authenticated attacker to inject and execute commands","start":287,"end":374}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection enables OS command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"the admin web interface allows an authenticated attacker to inject and execute commands","start":287,"end":374}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-cc205ca91d4f5c5b85cc","title":"Iran-Based Threat Actor Exploits VPN Vulnerabilities","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a","date":null,"mentions":[{"quote":"CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.","start":1953,"end":2103}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-3210","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3210","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":47354,"url":"https://www.exploit-db.com/exploits/47354","title":"Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - Remote Code Execution","type":"remote","platform":"multiple","date":"2019-09-06","verified":false,"provenance":"source"},{"id":47700,"url":"https://www.exploit-db.com/exploits/47700","title":"Pulse Secure VPN - Arbitrary Command Execution (Metasploit)","type":"remote","platform":"multiple","date":"2019-11-20","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-09-06"},"pocGithub":{"count":1,"skipped":0,"earliest":"2019-09-04","earliestUrl":"https://github.com/0xDezzy/CVE-2019-11539","repos":[{"name":"0xDezzy/CVE-2019-11539","url":"https://github.com/0xDezzy/CVE-2019-11539","stars":132,"created":"2019-09-04"}]},"metasploit":[{"name":"Pulse Secure VPN Arbitrary Command Execution","module":"exploit/linux/http/pulse_secure_cmd_exec","type":"exploit","disclosureDate":"2019-04-24","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_cmd_exec.rb"}],"first":{"date":"2019-04-24","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_cmd_exec.rb"},"provenance":"source"},"exploitRefs":["https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html","http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-04-24","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2019-09-04, Exploit-DB 2019-09-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_cmd_exec.rb","provenance":"source"},{"date":"2019-04-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11539","provenance":"source"},{"date":"2019-10-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3210","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":922},"priority":{"score":81.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2584 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 3 NVD exploit links; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}