CVE-2019-11539VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2019-11539: Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability

Affects Ivanti Pulse Connect Secure and Pulse Policy SecureSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
Ransomware: Used in ransomware campaigns
EPSS: 98.5% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-11539 (opens in a new tab)

Description

CVE-2019-11539 is a command injection vulnerability in Ivanti Pulse Connect Secure and Pulse Policy Secure. It allows an authenticated attacker with access to the admin web interface to inject and execute arbitrary commands. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

Summary

Ivanti Pulse Connect Secure and Pulse Policy Secure contain a command injection vulnerability (CWE-78) that permits an authenticated attacker accessing the administrative web interface to inject and execute arbitrary commands on the affected system. This vulnerability has been actively exploited in the wild, including use in ransomware campaigns, indicating its critical impact on affected environments.

Impact

Successful exploitation allows an attacker with administrative web interface access to execute arbitrary commands, potentially leading to full system compromise. The vulnerability has been exploited in real-world attacks, including ransomware campaigns, increasing the risk to affected organizations.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative web interface access to trusted users and networks, and monitor for suspicious activity related to command execution attempts.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:29 UTC

Weaknesses

References

Related threats