CVE-2019-11510 Explained: Pulse Secure VPN Arbitrary File Read and Credential Theft

The vulnerability is a path traversal flaw in the Pulse Connect Secure web server's URL handling. Certain URL paths intended for internal use do not enforce authentication checks. By manipulating the URL path with traversal sequences, an unauthenticated attacker can force the VPN appliance to read and return arbitrary files from the underlying filesystem.

The most impactful file accessible via CVE-2019-11510 is the session cache file, which stores session tokens, VPN configuration data, and — critically — cached plaintext or easily reversible credentials for Active Directory accounts that have authenticated through the VPN.

A single HTTP request to a crafted URL on a vulnerable Pulse Secure appliance returns the configuration database. Automated tools published within days of disclosure could scan the entire internet-facing Pulse Secure population and extract credentials in bulk. By the time most organizations became aware of the advisory, their credentials had already been extracted.

Affected products and versions include Pulse Connect Secure 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4. Pulse Policy Secure is also affected. The web administration portal and the user VPN portal are both vulnerable.

CVE-2019-11510 demonstrates a distinctive exploitation pattern: initial mass credential extraction followed by long-tail exploitation of those credentials years after the vulnerability was patched.

In August 2020 — a full year after disclosure — CISA Advisory AA20-010A warned that credentials extracted via CVE-2019-11510 were still being actively used to compromise targets. Organizations that had patched the VPN firmware but not rotated the credentials that were already stolen remained exposed. The vulnerability was closed; the breach was ongoing.

In 2020, a criminal forum published a list of over 900 enterprise and government Pulse Secure VPN server IP addresses with associated plaintext credentials extracted via CVE-2019-11510. The list included organizations in the healthcare, financial services, and defense sectors, as well as US government agencies.

Nation-state actors attributed to Iran, China, and Russia were all observed exploiting CVE-2019-11510, both during the initial exploitation wave and during the long-tail phase using cached credentials. Ransomware groups — particularly REvil and related affiliates — used extracted credentials as initial access for ransomware deployment campaigns.

Pulse Secure released patches in April 2019, four months before the public advisory. If you are still running vulnerable firmware, you have been exposed for years. The remediation has three mandatory steps: patch, rotate credentials, and investigate for compromise.

CVE-2019-11510 is a master class in why patching alone is insufficient when a credential-exposing vulnerability has been exploited at scale. The patch closes the file read. It does not close the Active Directory accounts whose passwords were in that file. It does not invalidate the session tokens that were cached. It does not undo months of access by threat actors who connected with the stolen credentials before the patch was applied.

Organizations that patched CVE-2019-11510 without rotating credentials discovered this the hard way — when ransomware operators used years-old extracted VPN credentials for initial access. The complete remediation is patch plus credential rotation plus compromise investigation. All three. In parallel.