CVE-2019-11510

Think of your company's VPN appliance as the front door to your internal network — employees use it to log in remotely. This bug lets a stranger walk up to that door without a key and reach inside to grab files, including the list of everyone's usernames and passwords. Once they have that, they can walk right through the front door as if they were an employee.

This matters to you if you run Pulse Connect Secure (formerly Pulse Secure PCS) on versions 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, or 9.0 before 9.0R3.4. These devices are typically internet-facing by design, so if you have one in this version range, it is almost certainly reachable by attackers right now.

Attackers are already exploiting this flaw in the wild, including in ransomware campaigns, and the US government has ordered federal agencies to patch it as a known active threat. There is no login or user interaction required, so any exposed, unpatched device is an open door. This is a red-alert situation — treat it as already under attack, not a theoretical risk.

1. Inventory all Pulse Connect Secure appliances and confirm exact firmware version via admin console or vendor support.
2. Confirm exposure: any internet-facing PCS gateway in the affected version range is exploitable without authentication.
3. Upgrade immediately to 8.2R12.1, 8.3R7.1, 9.0R3.4, or any later release — follow vendor advisory SA44101 for the upgrade path and any version-specific notes.
4. Treat this as a likely-breached environment: rotate all local and LDAP/AD credentials exposed through the VPN, revoke and reissue session cookies/tokens, and review cached credential files the flaw could expose.
5. CISA KEV due date for federal agencies was 2022-05-03; if you have not patched by now, you are years overdue — prioritize immediately.
6. No viable long-term workaround exists short of patching; if patching must be delayed, restrict access to the management/external interface via firewall ACLs or take the appliance offline temporarily.
7. Monitor for indicators of compromise: unexpected admin accounts, unfamiliar VPN sessions, modified system files, and outbound connections consistent with known PCS exploitation toolkits (webshells, credential dumping tools).
8. Two public exploits are known and actively used — assume automated scanning/exploitation attempts are ongoing against any exposed instance.

CVSS 3.1 score 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, reflecting unauthenticated, network-reachable, scope-changing compromise with full confidentiality/integrity/availability impact. Weakness: CWE-22 (Path Traversal) allowing arbitrary file read via crafted URI. Listed in CISA KEV since 2021-11-03, with confirmed use in ransomware campaigns; federal remediation deadline was 2022-05-03. Two public exploits are available, and EPSS places this at the 100th percentile for predicted exploitation likelihood (superseded here by confirmed KEV status). Attack vector requires no authentication and no user interaction, exploitable by default on any internet-facing instance.