Is CVE-2019-11510 actively exploited?

Yes. CVE-2019-11510 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2019-11510 be exploited remotely?

The attack vector of CVE-2019-11510 has not been classified yet.

What is the CVSS score of CVE-2019-11510?

CVE-2019-11510 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2019-11510

HIGHCISA KEVIN THE WILD

CVE-2019-11510

Published: November 3, 2021

EPSS:94.46%probability of exploitation in 30 daysPercentile:100.0th

Official Description

Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.

NVD Source

CISA KEV Advisory

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.

Added to KEV: 2021-11-03Federal patch deadline: 2022-05-03⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This arbitrary file read vulnerability in Ivanti Pulse Connect Secure allows an unauthenticated remote attacker to read arbitrary files by sending a specially crafted URI. This could lead to information disclosure. The very high EPSS score indicates a high likelihood of exploitation, making this a critical vulnerability.

This vulnerability is actively being exploited in the wild and is listed in CISA's KEV catalog, confirming its active exploitation. It is remotely exploitable via HTTPS with a specially crafted URI.

Recommended Action

Apply the latest security updates provided by Ivanti for Pulse Connect Secure. Restrict network access to the device and monitor for unusual file access attempts.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2019-11510 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2019-11510 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.