PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-11510 Ivanti CVE debrief

CVE-2019-11510 is a vulnerability in Ivanti Pulse Connect Secure that CISA lists in its Known Exploited Vulnerabilities catalog as an arbitrary file read issue. Because it is KEV-listed and marked for known ransomware campaign use, defenders should treat it as urgent and follow vendor remediation guidance without delay.

Vendor
Ivanti
Product
Pulse Connect Secure
CVSS
CRITICAL 9.9
CISA KEV
Listed
Original CVE published
2021-11-03
Original CVE updated
2026-09-27
Advisory published
2026-09-27
Advisory updated
2026-09-27

Who should care

Organizations running Ivanti Pulse Connect Secure appliances, especially internet-facing deployments, should prioritize this issue. Security teams, vulnerability management owners, and incident response staff should also care because CISA has identified active exploitation and referenced additional directive guidance.

Technical summary

The available source corpus identifies CVE-2019-11510 as an arbitrary file read vulnerability affecting Ivanti Pulse Connect Secure. CISA’s KEV entry indicates the issue has been exploited in the wild and includes a reference to ED 21-03 for mitigation requirements. The corpus does not provide deeper implementation details, so the safest action is to rely on vendor updates and CISA guidance rather than assumptions about specific attack flow.

Defensive priority

High. This is a KEV-listed vulnerability with a CISA due date and known ransomware campaign use, so remediation should be expedited and tracked to completion.

Recommended defensive actions

  • Apply updates per vendor instructions as directed by CISA.
  • Review and follow CISA ED 21-03 guidance for Pulse Connect Secure vulnerabilities.
  • Inventory all Ivanti Pulse Connect Secure instances, including externally exposed appliances.
  • Validate remediation status after patching and confirm vulnerable versions are no longer present.
  • Increase monitoring for signs of compromise on affected appliances and surrounding authentication or access logs.

Evidence notes

CISA’s Known Exploited Vulnerabilities catalog lists CVE-2019-11510 as an Ivanti Pulse Connect Secure arbitrary file read vulnerability, with dateAdded 2021-11-03 and dueDate 2022-05-03. The source metadata also marks knownRansomwareCampaignUse as Known and explicitly points to CISA ED 21-03 for further guidance. Official references provided include the CVE record, NVD detail page, and the CISA KEV catalog.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-11510 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-11510

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-11510 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-11510

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.