What’s Vulnerable › Vulnerabilities
CVE-2019-19781: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2021-11-03
- EPSS: 100.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-12-27 · updated 2026-08-12
- Weakness: CWE-22
Description
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
Affected products
- Citrix Application Delivery Controller Firmware: 10.5, 11.1, 12.0, 12.1, 13.0 (and their updates)
- Citrix Gateway Firmware: 13.0 (and their updates)
- Citrix Netscaler Gateway Firmware: 10.5, 11.1, 12.0, 12.1 (and their updates)
References
- http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html
- http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html
- https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/
- https://forms.gle/eDf3DXZAv96oosfj6
- https://support.citrix.com/article/CTX267027
- https://twitter.com/bad_packets/status/1215431625766424576
- https://www.kb.cert.org/vuls/id/619785
- http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html
Get alerted when CVE-2019-19781 or the next vulnerability affects your stack