CVE-2019-11539 Ivanti Pulse Connect Secure and Policy Secure Command Injection

Exploited in the wild High 8.0 Published 26 Apr 2019 Updated 21 Oct 2025

An authenticated attacker can inject and execute arbitrary commands via the admin web interface of Pulse Secure Connect Secure and Policy Secure appliances.

Exploited in the wild: Since 3 Nov 2021
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-11539?

CVE-2019-11539 is a high-severity command injection vulnerability in Ivanti Connect Secure, published on 26 Apr 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

Weakness: CWE-78

Which versions are affected by CVE-2019-11539?

It affects 3 products.

Products include Ivanti Connect Secure, Ivanti Policy Secure, Pulsesecure Pulse Policy Secure.

How do I fix CVE-2019-11539?

No fix has been published for CVE-2019-11539 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-11539 being exploited?

Yes. Attackers have exploited CVE-2019-11539 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 1 proofs of concept on GitHub.

All Ivanti Connect Secure vulnerabilities

Sources

Also known as GHSA-mchx-p635-vpq8.