CVE-2019-11510

Critical10.0 Published on May 8, 2019

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Nov 3, 2021
US federal agencies must remediate it by May 3, 2022 (BOD 22-01)
Attacked 8 days before the vulnerability was made public
Confirmed by sensors, not only by reports
Used in ransomware campaigns

Apply updates per vendor instructions.

Source: CISA KEV · Oct 7, 2026 Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Oct 1, 2026 Sep 30, 2026

CVSS score10.0 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-22, CWE-22

Vendorsivanti

Affected products

Vendors	Product	Versions
ivanti	connect secure	8.2

APT

FBI Seizes Seven Domains Supporting Flax Typhoon Scanning and Malware Operations

FBI seized domains allegedly supporting MicroScan and FishHub scanning and malware platforms attributed to China-linked Flax Typhoon operators.

Oct 8, 202623:05 6 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database