CVE-2017-11193: Pulse Connect Secure 8.3R1 has CSRF in diag.cgi.

Security readout for executives and security teams

This vulnerability lets a malicious website make an already logged-in Pulse Connect Secure administrator trigger built-in diagnostic network checks without consent. The cited issue is in Pulse Connect Secure 8.3R1 diag.cgi. It is not described as full device takeover, but it can misuse an administrative session and internal network reachability. Exposure is most likely where Pulse Connect Secure 8.3R1 is deployed and administrators access the management panel from browsers that may also visit untrusted sites. The source bundle does not establish other affected versions or products. Treat this as a targeted administrative-session risk. Prioritize if Pulse Connect Secure 8.3R1 is still present, especially where administrators manage it from standard browsing environments or broad internal networks. Mitigation focus: Check Pulse Secure or Ivanti guidance for fixed versions or vendor-recommended workarounds.; Restrict management-panel access to trusted administrative networks and authorized admin workstations.; Avoid browsing untrusted sites from browsers with active appliance admin sessions..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.