Pulse Secure / Pulse Connect Secure CVE-2019-11510 (unauthenticated arbitrary file read, CISA KEV): which versions are fixed and what must be reset after patching?

What it is: CVE-2019-11510 is a pre-authentication arbitrary file-read flaw in Pulse Connect Secure (PCS) SSL VPN appliances. An unauthenticated remote attacker can read files from the appliance, which can expose session data and credentials of VPN users. Pulse Secure released patches in April 2019, working exploits appeared by mid-2019, and CISA and others reported wide exploitation, including ransomware, for years afterward. It is in the CISA KEV catalog with ransomware use noted. Am I affected: - Pulse Connect Secure 8.2 before 8.2R12.1, 8.3 before 8.3R7.1 and 9.0 before 9.0R3.4 (NVD). CISA's advisory also lists the 8.1 branch and Pulse Policy Secure releases. - Check the appliance version in the admin console. Any unpatched appliance that was ever internet-facing should be treated as suspect, because a patch does not undo earlier credential theft. Fix: 1. Upgrade to a fixed release (8.2R12.1, 8.3R7.1, 9.0R3.4 or later), and in practice to the latest supported release for your product. CISA states there is no viable workaround other than patching. The product is now Ivanti Connect Secure, so use current Ivanti guidance and consider whether the appliance is still supported. 2. After patching, assume credentials may have been taken: force password resets for all VPN users and administrators, reset any service or LDAP bind accounts configured on the appliance, replace its certificates and keys, and invalidate active sessions. 3. Review authentication logs for unexpected logins, especially from unusual locations, and check the appliance and connected networks for unexpected administrator accounts, scheduled scripts or added files. Use the vendor integrity checker and rebuild or factory-reset if tampering is found. 4. Enforce MFA on the VPN so that stolen passwords alone are not enough. Verify: the appliance reports a fixed (or newer) version, credentials were rotated after the patch, and the integrity check is clean. Sources: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-010a https://nvd.nist.gov/vuln/detail/CVE-2019-11510 https://www.cisa.gov/known-exploited-vulnerabilities-catalog