CVE-2019-11510: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

CVE-2019-11510 is an arbitrary file read vulnerability in Ivanti Pulse Connect Secure. An unauthenticated remote attacker with network access via HTTPS can send a specially crafted URI to read files on the device. This matters because the product is commonly deployed as a remote-access VPN gateway; successful abuse can expose configuration, credentials, or other sensitive data and has been tied to ransomware activity.

Defenders should treat internet-facing instances as high priority until they confirm the vendor fix is applied and residual exposure is checked.

How it works

The weakness is classified as CWE-22 (path traversal / improper limitation of a pathname). In this class of flaw, the application fails to adequately sanitize user-supplied path elements in a request. An attacker who can reach the HTTPS interface crafts a URI that causes the appliance to return the contents of files outside the intended web root or document store.

Because the CISA summary states the attack requires no authentication and only network access over HTTPS, the practical abuse path is straightforward: the attacker targets the exposed management or user portal endpoint, supplies the malicious URI, and retrieves file contents. Exact request format and which files are reachable must be confirmed against the vendor advisory; do not rely on third-party write-ups alone for detection logic.

Am I affected? How to find it in your systems

Ivanti Pulse Connect Secure (formerly Pulse Secure) typically runs as a hardware or virtual appliance providing SSL VPN and remote access. It is often placed at the network edge and reachable from the internet on TCP 443.

• Inventory: Query asset management, CMDB, or network discovery for hosts identified as Pulse Connect Secure / Ivanti PCS. Check firewall and load-balancer rules for HTTPS services that terminate on these appliances.
• Version and configuration: Compare the running software build against the fixed releases listed in the vendor advisory. Confirm whether the appliance is internet-facing or reachable from untrusted networks.
• Telemetry signs: Look for unusual HTTPS requests containing path-traversal sequences or unexpected file-path patterns in web access logs, reverse-proxy logs, or WAF logs. Sudden spikes in 200 responses for non-standard URIs, or outbound connections from the appliance after anomalous requests, warrant investigation. Exact indicators of compromise should be validated against vendor and trusted threat-intel guidance.

How to remediate

Patch first. Apply the updates published by Ivanti for Pulse Connect Secure exactly as described in the vendor advisory and follow the CISA required action: apply updates per vendor instructions. After patching, verify the new build is running and re-check that the previously vulnerable URI patterns no longer return file contents.

Additional hardening for this class of issue:

• Restrict management and portal interfaces to trusted networks or require additional access controls (VPN, IP allow-lists, MFA) wherever operationally feasible.
• Ensure the appliance is not unnecessarily exposed on the public internet; place it behind a reverse proxy or WAF that can enforce strict URI normalization.
• Rotate any credentials, certificates, or secrets that may have resided on the device if you have evidence of prior exploitation.
• Review and tighten logging so that future anomalous file-access attempts are captured and alerted.

If you can't patch immediately

Until the vendor update can be installed, reduce risk with compensating controls:

• Network segmentation and access restriction: Limit source IPs that can reach the HTTPS portal to known corporate ranges or jump hosts. Block general internet access if business needs allow.
• Virtual patching / WAF: Deploy or tune a web application firewall or reverse-proxy rules to reject requests containing path-traversal patterns (directory traversal sequences, encoded equivalents, and attempts to reach sensitive system paths). Test rules carefully to avoid breaking legitimate clients.
• Feature and interface reduction: Disable any unused portal features or alternate interfaces that increase attack surface; confirm with vendor documentation which components can be safely turned off.
• Heightened monitoring: Increase log retention and alerting on the appliance and any front-end proxies. Watch for reconnaissance and repeated crafted URIs; prepare an incident-response path if exploitation is suspected.

These measures lower likelihood and impact but do not replace the official patch.

If your data may have been exposed

This vulnerability has been used in ransomware campaigns. If your Pulse Connect Secure instance was internet-facing and unpatched during the period of known exploitation, assume sensitive files may have been read and treat the incident as a potential breach. Follow your incident-response process: isolate affected systems, preserve logs, rotate credentials and certificates that could have been obtained, and assess downstream impact on connected identity and network resources. You can run a free exposure scan of your email addresses against known breach data sets to check whether associated accounts appear in public breach corpora while you complete containment and recovery.