CVE-2019-11510: Pulse Connect Secure path traversal allows unauthenticated file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable arbitrary file read on an internet-facing VPN with CVSS 10, KEV listing, ransomware use and near-certain EPSS score.

What it is

Pulse Connect Secure versions 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 contain a path traversal (CWE-22) flaw. An unauthenticated remote attacker can send a crafted URI to read arbitrary files on the appliance. Because these devices terminate VPN access, exposed file contents can include credentials and session material that enable deeper intrusion.

Impact

An attacker gains unauthenticated read access to arbitrary files on the VPN appliance, which can expose stored credentials, session tokens and configuration data. That access has been used as a stepping stone toward full compromise of the device and the internal network behind it.

Attack surface

Reachable over the network via a crafted URI to the Pulse Connect Secure web interface; the CVSS vector shows no privileges and no user interaction required. Any internet-exposed or otherwise reachable management/VPN interface is in scope.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is 0.99999 (99.996th percentile). Multiple references are tagged Exploit, confirming public exploit material exists.

What to do

• Upgrade to Pulse Connect Secure 8.2R12.1, 8.3R7.1, 9.0R3.4 or later per the vendor advisory SA44101.
• If patching cannot be done immediately, remove the appliance from direct internet exposure or restrict access to trusted source addresses.
• Rotate credentials, certificates and session secrets that may have been stored on or readable from the device.
• Run the vendor's Integrity Checker Tool to look for prior compromise before trusting the appliance.
• Monitor vendor and CISA guidance for follow-on fixes, since this flaw has been chained with others.

Detection

• Search web/proxy logs for requests containing path traversal sequences (../, encoded variants) against Pulse Connect Secure URIs.
• Alert on unexpected outbound connections or new processes/files on the VPN appliance.
• Review authentication logs for logins using accounts whose credentials resided on the appliance.
• Use the vendor Integrity Checker Tool output and compare file hashes against known-good baselines.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.