CVE-2019-11540: Ivanti Connect Secure

Critical severity, CVSS 9.8. EPSS: 7.7% chance of exploitation in the next 30 days.

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack.

Affected products

• Ivanti Connect Secure: version 8.3 only
• Pulse Secure Pulse Connect Secure: version 8.3rx only; version 9.0r1 only; version 9.0r2 only; version 9.0r2.1 only; version 9.0r3 only; version 9.0r3.1 only; …
• Pulse Secure Pulse Policy Secure: version 5.4r1 only; version 5.4r2 only; version 5.4r2.1 only; version 5.4r3 only; version 5.4r4 only; version 5.4r5 only; …

Published 2019-04-26. Last modified 2026-06-17.