Cyber Resilience

CVE-2019-11539

HighCISA KEVActive ExploitationEUVD ExploitedPublic PoCRansomware-linkedRCE

Published: 26 April 2019

Published
26 April 2019
Modified
06 November 2025
KEV Added
03 November 2021
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9390 99.9th percentile
Risk Priority 91 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-11539 is a high-severity OS Command Injection (CWE-78) vulnerability in Ivanti Connect Secure. Its CVSS base score is 7.2 (High).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The vulnerability is an OS command injection flaw (CWE-78) present in the admin web interface of Pulse Secure Pulse Connect Secure versions 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, as well as Pulse Policy Secure versions 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1. It carries a CVSS 3.1 score of 7.2 with network attack vector and high impact on confidentiality, integrity, and availability.

An authenticated attacker with administrative privileges can exploit the flaw over the network to inject and execute arbitrary commands on the affected appliance, achieving full system compromise without user interaction.

Public references document working exploit code for the affected versions along with analysis of chained remote code execution paths that leverage this issue in SSL VPN deployments.

EU & UK References

Vulnerability details

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before…

more

5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

CWE(s)
CWE-78
KEV Date Added
03 November 2021

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ivanti
connect secure
8.1, 8.2, 8.3, 9.0
ivanti
policy secure
9.0
pulsesecure
pulse policy secure
5.1r1.0, 5.1r1.1, 5.1r10.0, 5.1r11.0, 5.1r11.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of all inputs to the admin web interface, blocking the OS command injection payload before execution.

SI-2 Flaw Remediation good match
prevent

Mandates timely application of vendor patches that close the command-injection flaw in the listed Pulse Secure versions.

SI-4 System Monitoring partial match
detect

Requires continuous monitoring of the admin interface and system processes to identify anomalous command execution or post-exploitation activity.

References