{"id":"CVE-2019-11539","published":"2019-04-26T02:29:00Z","modified":"2026-06-17T02:13:07Z","title":"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability","vendor":"Ivanti","product":"Pulse Connect Secure and Pulse Policy Secure","tier":"core","eol":null,"description":{"text":"In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.","provenance":"source","from":"NVD"},"summary":{"text":"Ivanti's Pulse Connect Secure and Pulse Policy Secure products contain a command injection flaw in their admin web interface, affecting specific pre-patch releases of each product. An attacker who has already authenticated over the network with high-privilege admin access can inject and execute operating system commands on the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:27Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98544,"percentile":0.99922,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11539","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-10-02","exploitedFirstSeen":"2019-10-02","ransomware":true,"evidence":[{"url":"https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities","date":"2019-10-02"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-259a","date":"2020-09-15"},{"url":"https://www.esentire.com/security-advisories/ransomware-groups-exploit-remote-access-services","date":"2020-09-17"},{"url":"https://cdn.pathfactory.com/assets/10753/contents/298161/03f15d14-01bb-462b-a8d4-d8c6149f5604.pdf","date":"2021-03-05"},{"url":"https://cybersecurityworks.com/patchwatch/patch-watch-csw-analysis-of-pulse-secure-vulnerabilities.html","date":"2021-05-21"},{"url":"https://www.hhs.gov/sites/default/files/revil-update-tlpwhite.pdf","date":"2021-08-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://cert-in.org.in/PDF/RANSOMWARE_Report_2022.pdf","date":"2023-04-22"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement","date":"2024-04-04"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/108073","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","tags":["Exploit","Third Party Advisory"]},{"url":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","tags":["Exploit","Third Party Advisory"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101","tags":["Third Party Advisory","Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/927237","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/108073","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","tags":["Exploit","Third Party Advisory"]},{"url":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","tags":["Exploit","Third Party Advisory"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101","tags":["Third Party Advisory","Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/927237","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires authenticated admin access via valid credentials","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"the admin web interface allows an authenticated attacker to inject and execute commands","start":287,"end":374}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection enables OS command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"the admin web interface allows an authenticated attacker to inject and execute commands","start":287,"end":374}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-cc205ca91d4f5c5b85cc","title":"Iran-Based Threat Actor Exploits VPN Vulnerabilities","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a","date":null,"mentions":[{"quote":"CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.","start":1953,"end":2103}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-3210","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3210","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":47354,"url":"https://www.exploit-db.com/exploits/47354","title":"Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - Remote Code Execution","type":"remote","platform":"multiple","date":"2019-09-06","verified":false,"provenance":"source"},{"id":47700,"url":"https://www.exploit-db.com/exploits/47700","title":"Pulse Secure VPN - Arbitrary Command Execution (Metasploit)","type":"remote","platform":"multiple","date":"2019-11-20","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-09-06"},"pocGithub":{"count":1,"skipped":0,"earliest":"2019-09-04","earliestUrl":"https://github.com/0xDezzy/CVE-2019-11539","repos":[{"name":"0xDezzy/CVE-2019-11539","url":"https://github.com/0xDezzy/CVE-2019-11539","stars":132,"created":"2019-09-04"}]},"metasploit":[{"name":"Pulse Secure VPN Arbitrary Command Execution","module":"exploit/linux/http/pulse_secure_cmd_exec","type":"exploit","disclosureDate":"2019-04-24","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_cmd_exec.rb"}],"first":{"date":"2019-04-24","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_cmd_exec.rb"},"provenance":"source"},"exploitRefs":["https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html","http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-04-24","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2019-09-04, Exploit-DB 2019-09-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_cmd_exec.rb","provenance":"source"},{"date":"2019-04-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11539","provenance":"source"},{"date":"2019-10-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3210","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":922},"priority":{"score":78.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2587 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 3 NVD exploit links; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}