CVE-2019-11543: Ivanti Connect Secure

Medium severity, CVSS 6.1. EPSS: 3.1% chance of exploitation in the next 30 days.

XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1.

Affected products

• Ivanti Connect Secure: version 8.1 only; version 8.3 only
• Pulse Secure Pulse Connect Secure: version 8.1r1.0 only; version 8.1rx only; version 8.3rx only; version 9.0r1 only; version 9.0r2 only; version 9.0r2.1 only; …
• Pulse Secure Pulse Policy Secure: version 5.2r1.0 only; version 5.2r2.0 only; version 5.2r3.0 only; version 5.2r3.2 only; version 5.2r4.0 only; version 5.2r5.0 only; …

Published 2019-04-26. Last modified 2026-06-17.