Live › vulnerability › CVE-2019-11539
Go to dashboardIvanti Pulse Connect Secure and Pulse Policy Secure contain a command injection flaw in the admin web interface. An authenticated attacker with admin access can inject operating system commands and have them executed on the appliance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Ivanti Pulse Connect Secure and Pulse Policy Secure | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the updates per Ivanti vendor instructions (version not stated in the sources).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
This page as .md · .json · in your agent: get_signal("CVE-2019-11539")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.