{"history":[{"alert":0,"cve":"CVE-2019-11539","id":21771,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.98544, \"percentile\": 0.99922}"},{"alert":0,"cve":"CVE-2019-11539","id":19388,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.98544, \"percentile\": 0.99922}"},{"alert":0,"cve":"CVE-2019-11539","id":17354,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.98544, \"percentile\": 0.99922}"},{"alert":0,"cve":"CVE-2019-11539","id":15417,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.98544, \"percentile\": 0.99922}"},{"alert":0,"cve":"CVE-2019-11539","id":13395,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.98544, \"percentile\": 0.99921}"},{"alert":0,"cve":"CVE-2019-11539","id":11177,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.98544, \"percentile\": 0.99921}"},{"alert":1,"cve":"CVE-2019-11539","id":10708,"kind":"cna","observed_at":1793960400,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-04T22:55:40.818Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101\"}, {\"name\": \"108073\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"], \"url\": \"http://www.securityfocus.com/bid/108073\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/\"}, {\"name\": \"VU#927237\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT-VN\", \"x_transferred\"], \"url\": \"https://www.kb.cert.org/vuls/id/927237\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2019-11539\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-02-03T15:40:52.619006Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2021-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:45:38.985Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2021-11-03T00:00:00.000Z\", \"value\": \"CVE-2019-11539 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"n/a\", \"vendor\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.\"}], \"metrics\": [{\"cvssV3_0\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N\", \"version\": \"3.0\"}}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"n/a\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2021-04-06T15:06:16.000Z\", \"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\"}, \"references\": [{\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101\"}, {\"name\": \"108073\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"], \"url\": \"http://www.securityfocus.com/bid/108073\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/\"}, {\"name\": \"VU#927237\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT-VN\"], \"url\": \"https://www.kb.cert.org/vuls/id/927237\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"cve@mitre.org\", \"ID\": \"CVE-2019-11539\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"n/a\", \"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}}]}, \"vendor_name\": \"n/a\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.\"}]}, \"impact\": {\"cvss\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N\", \"version\": \"3.0\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101\", \"refsource\": \"CONFIRM\", \"url\": \"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101\"}, {\"name\": \"108073\", \"refsource\": \"BID\", \"url\": \"http://www.securityfocus.com/bid/108073\"}, {\"name\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010\", \"refsource\": \"CONFIRM\", \"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010\"}, {\"name\": \"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf\", \"refsource\": \"MISC\", \"url\": \"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf\"}, {\"name\": \"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html\"}, {\"name\": \"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/\", \"refsource\": \"MISC\", \"url\": \"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/\"}, {\"name\": \"VU#927237\", \"refsource\": \"CERT-VN\", \"url\": \"https://www.kb.cert.org/vuls/id/927237\"}, {\"name\": \"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html\"}, {\"name\": \"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html\", \"refsource\": \"MISC\", \"url\": \"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"assignerShortName\": \"mitre\", \"cveId\": \"CVE-2019-11539\", \"datePublished\": \"2019-04-26T01:39:36.000Z\", \"dateReserved\": \"2019-04-25T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:45:38.985Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2019-11539","id":8923,"kind":"epss","observed_at":1793895600,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.98544, \"percentile\": 0.99921}"},{"alert":0,"cve":"CVE-2019-11539","id":6711,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.98544, \"percentile\": 0.99921}"},{"alert":0,"cve":"CVE-2019-11539","id":4488,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.98544, \"percentile\": 0.99922}"},{"alert":0,"cve":"CVE-2019-11539","id":2270,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.98544, \"percentile\": 0.99922}"},{"alert":1,"cve":"CVE-2019-11539","id":1704,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2019-11539\", \"cwes\": [\"CWE-78\"], \"dateAdded\": \"2021-11-03\", \"dueDate\": \"2022-05-03\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2019-11539\", \"product\": \"Pulse Connect Secure and Pulse Policy Secure\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.\", \"vendorProject\": \"Ivanti\", \"vulnerabilityName\": \"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability\"}"}],"record":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-04T22:55:40.818Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101"},{"name":"108073","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/108073"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/"},{"name":"VU#927237","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"https://www.kb.cert.org/vuls/id/927237"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2019-11539","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-03T15:40:52.619006Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2021-11-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:45:38.985Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539"}],"timeline":[{"lang":"en","time":"2021-11-03T00:00:00.000Z","value":"CVE-2019-11539 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands."}],"metrics":[{"cvssV3_0":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-04-06T15:06:16.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101"},{"name":"108073","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/108073"},{"tags":["x_refsource_CONFIRM"],"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010"},{"tags":["x_refsource_MISC"],"url":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html"},{"tags":["x_refsource_MISC"],"url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/"},{"name":"VU#927237","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"https://www.kb.cert.org/vuls/id/927237"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-11539","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands."}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101","refsource":"CONFIRM","url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101"},{"name":"108073","refsource":"BID","url":"http://www.securityfocus.com/bid/108073"},{"name":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010","refsource":"CONFIRM","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010"},{"name":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","refsource":"MISC","url":"https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf"},{"name":"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html"},{"name":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","refsource":"MISC","url":"https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/"},{"name":"VU#927237","refsource":"CERT-VN","url":"https://www.kb.cert.org/vuls/id/927237"},{"name":"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html"},{"name":"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2019-11539","datePublished":"2019-04-26T01:39:36.000Z","dateReserved":"2019-04-25T00:00:00.000Z","dateUpdated":"2025-10-21T23:45:38.985Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1793960400,"cve":"CVE-2019-11539","description":"In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.","epss":{"date":"2026-11-12","epss":0.98544,"percentile":0.99922},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2019-11539","cwes":["CWE-78"],"dateAdded":"2021-11-03","dueDate":"2022-05-03","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11539","product":"Pulse Connect Secure and Pulse Policy Secure","requiredAction":"Apply updates per vendor instructions.","shortDescription":"Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.","vendorProject":"Ivanti","vulnerabilityName":"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability"},"kev_checked":1794522003,"products":"n/a n/a","references":["https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101","http://www.securityfocus.com/bid/108073","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010","https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf","http://packetstormsecurity.com/files/154376/Pulse-Secure-8.1R15.1-8.2-8.3-9.0-SSL-VPN-Remote-Code-Execution.html","https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","https://www.kb.cert.org/vuls/id/927237","http://packetstormsecurity.com/files/155277/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","http://packetstormsecurity.com/files/162092/Pulse-Secure-VPN-Arbitrary-Command-Execution.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11539"],"score":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","provider":"mitre","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N","version":"3.0"},"solutions":"","state":"PUBLISHED","title":"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}