CVE-2019-11510 Ivanti Pulse Connect Secure Arbitrary File Read

Exploited in the wild Critical 9.9 Published 8 May 2019 Updated 21 Oct 2025

Unauthenticated attackers can read arbitrary files on Pulse Secure PCS appliances via crafted URIs, exposing sensitive configuration and user data.

Exploited in the wild: Since 3 Nov 2021
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-11510?

CVE-2019-11510 is a critical path traversal vulnerability in Ivanti Connect Secure, published on 8 May 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

Weakness: CWE-22

Which versions are affected by CVE-2019-11510?

It affects 1 product.

Products include Ivanti Connect Secure.

How do I fix CVE-2019-11510?

No fix has been published for CVE-2019-11510 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-11510 being exploited?

Yes. Attackers have exploited CVE-2019-11510 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 13 proofs of concept on GitHub.

All Ivanti Connect Secure vulnerabilities

Sources

Also known as GHSA-6wr2-qx99-98mg.