CVE-2019-11510

VendorivantiProductconnect secureDiscoveredMay 8, 2019UpdatedNov 6, 2025

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

View graph Watch Export

CVSS v3.1

10 CRITICAL

EPSS

99.9%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Connections

4 relationships

CWE-22

source

Timeline

disclosure → media coverage

May 8, 2019

Disclosure — published as a CVE record. · last revised by NVD Nov 6, 2025

Aug 27, 2026

theregister.com reports: FBI seizes hacking tools it says China used to attack NASA, DOE, US Senate and other critical networks

Public PoC (10)

github.com/projectzeroindia/CVE-2019-11510 github.com/nuc13us/Pulse github.com/imjdl/CVE-2019-11510-poc github.com/es0/CVE-2019-11510_poc github.com/r00tpgp/http-pulse_ssl_vpn.nse github.com/jas502n/CVE-2019-11510-1 github.com/jason3e7/CVE-2019-11510 github.com/BishopFox/pwn-pulse github.com/aqhmal/pulsexploit github.com/cisagov/check-your-pulse

Unverified third-party code — review before executing.