CVE-2019-11539

Ivanti Pulse Connect Secure and Policy Secure Command Injection

7.2 HIGHActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 98.5%

Published26 Apr 2019
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredHigh

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Ivanti Connect Secure8.1 · 8.2 · 8.3 · 9.0

Ivanti Policy Secure9.0

Pulsesecure Pulse Policy Secure5.1r1.0 · 5.1r10.0 · 5.1r1.1 · 5.1r11.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101

References

http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.htmlThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.htmlBroken LinkThird Party AdvisoryVDB Entry
https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ExploitThird Party Advisory
https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdfExploitThird Party Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101Third Party AdvisoryVendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539US Government Resource
https://www.kb.cert.org/vuls/id/927237Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/108073Broken LinkThird Party AdvisoryVDB Entry

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-11539 being actively exploited?

Yes. CVE-2019-11539 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021. It has been used in ransomware campaigns.

How severe is CVE-2019-11539?

CVE-2019-11539 has a CVSS 3.1 base score of 7.2, rated high. EPSS estimates a 98.5% probability of exploitation.

Which products are affected by CVE-2019-11539?

Affected products include Ivanti Connect Secure, Ivanti Policy Secure, Pulsesecure Pulse Policy Secure.

How do I fix CVE-2019-11539?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-11539 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.