Loading story…
Pulse Secure SSL VPN appliances were affected by seven vulnerabilities, led by the critical pre-authentication arbitrary file-read flaw CVE-2019-11510 and authenticated administrative command injection CVE-2019-11539. The defects affected multiple Pulse Connect Secure and Pulse Policy Secure releases; Pulse Secure issued fixes on April 24, 2019, following private disclosure by DEVCORE researchers.
Public exploit availability prompted broad Internet scanning, and more than 14,500 Pulse Secure VPN endpoints were reported vulnerable to CVE-2019-11510. Researchers cited intelligence linking exploitation to a China-associated APT group and demonstrated that chaining the flaws with session-management weaknesses, SSRF, and compromised administrator credentials could yield remote code execution; organizations should urgently apply vendor patches, identify exposed appliances, rotate potentially exposed credentials, enforce MFA and client certificates where feasible, and centralize audit logging.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Thirty days after the Pulse Secure patch release, the researchers began testing Twitter's SSL VPN in a bug-bounty case study. They later reported chaining file read, session weaknesses, WebVPN SSRF, a cracked administrator credential, and CVE-2019-11539 to achieve remote code execution.
Pulse Secure released patches for the vulnerabilities reported by DEVCORE, affecting specified Pulse Connect Secure and Pulse Policy Secure versions.
DEVCORE researchers Orange Tsai and Meh Chang reported seven vulnerabilities in Pulse Secure SSL VPN products to Pulse Secure PSIRT, including the pre-authentication arbitrary file-read flaw CVE-2019-11510 and administrative command injection CVE-2019-11539.
The researchers cited intelligence indicating that an unidentified China-linked APT group was exploiting the Pulse Secure vulnerability.
Third parties released public exploits for the Pulse Secure flaws, after which the researchers observed increased botnet scanning for vulnerable systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA and Mandiant reported that attackers exploited **Pulse Connect Secure** VPN vulnerabilities—including `CVE-2019-11510` and the later zero-day `CVE-2021-22893`—to gain initial access to government and other high-value networks, bypass authentication controls, and steal credentials. In one CISA incident response case, a federal civilian agency was compromised after the actor used valid **Office 365** and domain administrator credentials, likely obtained in part through Pulse Secure exploitation, to access email and SharePoint data, enumerate **Active Directory**, move laterally, and stage files for likely exfiltration. The intrusion was detected through **EINSTEIN**, and CISA said the actor maintained command and control with scheduled tasks, SSH tunneling, reverse SOCKS proxies, mounted remote shares, PowerShell proxy tooling, and custom malware including `inetinfo.exe`. Mandiant said multiple intrusions involved compromised Pulse Secure appliances that retained persistence even after upgrades, with attackers deploying web shells and malware families such as **SLOWPULSE**, **RADIALPULSE**, **PULSECHECK**, **SLIGHTPULSE**, **ATRIUM**, and **STEADYPULSE**, while **THINBLOOD** was used to wipe logs. The activity was linked to clusters **UNC2630** and **UNC2717**, which targeted the U.S. defense industrial base and global government agencies, respectively, and in some cases used trojanized components to log credentials or bypass LDAP, RADIUS, and other MFA flows with a backdoor password. CISA’s alert `AA21-110A`, Emergency Directive `21-03`, and vendor guidance urged organizations to patch affected appliances, apply mitigations, enable unauthenticated request logging, run integrity checks, and hunt for published indicators of compromise across VPN and authentication logs.
Aug 15, 2026
DEVCORE researchers published offensive research describing a remote-code-execution chain affecting **Pulse Secure SSL VPN** appliances, using Twitter as a case study. The work highlighted how chained vulnerabilities in internet-facing VPN infrastructure can provide a path from unauthenticated access to execution on the appliance, placing internal networks and authentication systems at risk. Researcher Orange Tsai also disclosed flaws in roughly 250,000 internet-exposed Taiwanese home modems, largely associated with Chunghwa Telecom. An ISP configuration exposed an unauthenticated management and debugging service on TCP port `3097`; arbitrary file reading and an unauthenticated RCE path could enable modem compromise and access to subscriber home networks. The issues were tracked as **CVE-2019-13411**, **CVE-2019-13412**, **CVE-2019-15064**, **CVE-2019-15065**, and **CVE-2019-15066**, with firmware remediation reported before disclosure.
Sep 3, 2026
Check Point disclosed and patched **`CVE-2024-24919`**, a critical information disclosure flaw affecting Internet-connected **Network Security Gateway** devices with **Remote Access VPN** or **Mobile Access** enabled. The vulnerability was traced to improper HTTP `POST` request validation that can enable directory traversal and arbitrary file reads by an unauthenticated attacker, allowing exposure of sensitive data from affected gateways. Check Point said it observed exploitation attempts in the wild, issued an initial mitigation, then released a mandatory hotfix and urged customers to apply it immediately. Reported abuse focused on remote-access environments, particularly older local VPN accounts using password-only authentication. Stolen data may include local account password hashes, private SSH keys, certificates, and potentially Active Directory-related files such as `ntds.dit`, creating follow-on risk of credential theft, lateral movement, broader network intrusion, and possible escalation toward remote code execution. Check Point and external responders advised organizations to disable unused local accounts, enforce stronger authentication such as MFA or certificates, rotate exposed credentials, and review gateway and authentication logs for signs of compromise.
Jul 24, 2026