Is CVE-2019-11510 (Ivanti Pulse Connect Secure Arbitrary File Read) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2019-11510 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.

What this alert means for Pulse Connect Secure users

This is not just a historical CVE entry. Because CISA placed CVE-2019-11510 in the Known Exploited Vulnerabilities catalogue, defenders should treat any exposed Ivanti Pulse Connect Secure appliance as actively targetable and verify whether the issue was ever reachable from the internet. For VPN edge devices, exposure is often the first condition that turns a software flaw into a real incident.

A practical first step is to confirm whether the appliance is internet-facing, whether it was patched or mitigated in time, and whether any emergency controls were applied before the KEV listing. For broader context on how to triage and respond to actively exploited vulnerabilities, the key question is whether the device remained reachable during the window when exploitation was already known to be happening.

The vulnerability itself matters because it is an arbitrary file read reached through HTTPS by an unauthenticated remote attacker with network access. That means the primary concern is not just service disruption, but exposure of configuration data, session material, and other sensitive files that can help an attacker move from initial access to deeper compromise.

How exploitation changes the response

When a flaw is being used in the wild, the response shifts from routine patch management to exposure control and compromise assessment. You should review whether the device was only vulnerable in theory or whether logs, outbound connections, configuration access, or unusual authentication events suggest it was actually touched before remediation. For appliance-class issues, the safest assumption is that exploitation may have occurred even if there is no obvious user-visible outage.

That is why CISA KEV listings are operationally important: they signal that the question is no longer “could this be exploited?” but “was it exploited here, and what did it expose?” The practical implication is that patching alone is not enough if the appliance may have leaked credentials, session data, or configuration secrets before the fix was applied. If the appliance was used for remote access, also check whether any privileged user, service account, or VPN-related secret should be rotated after containment.

For defenders running a broader vulnerability program, the most useful companion resource is Vulnerability Management Guide, because KEV status should feed directly into prioritisation, exception handling, and verification rather than being tracked as a standalone ticket.

What to check before you declare the device clean

Do not rely only on a successful patch status. Review appliance logs for access patterns that match file retrieval, configuration export, suspicious administrative activity, and sign-ins that do not fit normal remote access behavior. Also confirm whether the device stored credentials, tokens, certificates, or other sensitive material that could have been exposed by file-read access.

If the appliance supported enterprise remote access, treat the blast radius as wider than the device itself. The most relevant follow-on question is whether an attacker could have used the appliance to harvest information that helps them authenticate elsewhere or impersonate trusted traffic. That is why the investigation should include adjacent systems, not just the VPN box.

For additional operational detail on edge-device response, VPN Security Guide and Ivanti Connect Secure exploitation 2024 are useful references for the kinds of evidence and downstream exposure defenders should expect on internet-facing VPN platforms.

Risk and Threat Considerations

Internet-facing VPN appliances are high-value targets because they sit on a trust boundary and often hold sensitive configuration, session, and authentication material. Once a file-read flaw is known to be exploited, the risk is not limited to the single vulnerable URI path, because exposed files can reveal enough internal detail to enable later abuse or follow-on intrusion.

Failure mechanism: An unauthenticated remote attacker reaches the appliance over HTTPS, requests crafted URIs, and reads files that were never meant to be exposed. If those files include secrets, configuration, or session-related material, the attack can progress from disclosure to broader compromise without needing a valid login at the start.

Impact: The likely impact is exposure of sensitive data, credential reuse opportunities, and loss of trust in the remote access perimeter. In practice, that can force credential rotation, session invalidation, and a wider compromise review across systems that depended on the appliance.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	CVE response depends on timely remediation of a known exploited flaw.
	IR-4 — Incident Handling	Active exploitation requires investigation and containment beyond patching.
	IA-5 — Authenticator Management	File-read exposure can leak secrets or tokens that must be rotated.
Recommendation — Apply SI-2 to track, prioritize, and remediate the exposed appliance flaw promptly. Use IR-4 to investigate possible compromise and contain affected appliances. Use IA-5 to rotate exposed credentials, keys, and other authenticators promptly.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation calls for urgent identification and remediation of vulnerable assets.
	CIS-12 — Network Infrastructure Management	The subject is a network edge appliance that must be hardened and monitored.
Recommendation — Prioritize this CVE under CIS-7 and verify remediation across all exposed appliances. Harden and monitor the VPN appliance under CIS-12 to reduce exposure and improve detection.
OWASP Non-Human Identity Top 10	NHI-02 — Secret Leakage	Arbitrary file read can expose credentials, tokens, and other secret material.
	NHI-07 — Long-Lived Secrets	VPN appliances often retain secrets that become high value when exposed by a file-read flaw.
Recommendation — Treat any accessible secrets as compromised and rotate them immediately. Reduce secret lifetime and replace long-lived credentials that could be read from the appliance.
MITRE ATT&CK	T1210 — Exploitation of Remote Services	The CVE is an internet-reachable remote exploitation path against an edge service.
Recommendation — Map exposure to T1210 and hunt for signs of remote exploitation against the appliance.

Practitioner Guidance

What to prioritise: Treat KEV-listed edge devices as exposure problems first and patch problems second. If the appliance was internet-facing while vulnerable, prioritise compromise assessment and secret rotation before you close the ticket as “remediated.”

What to verify: Confirm whether any administrative credentials, VPN configuration secrets, certificates, or session material were stored on or accessible through the appliance. If the environment cannot prove those assets were never exposed, assume blast radius and take containment actions.

Practitioner takeaway: For exploited VPN flaws, the right question is not whether the patch is installed now, but whether the appliance exposed anything that could still be abused after the patch went in.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org