CVE-2019-19781

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

Published Dec 27, 2019 · updated Aug 11, 2026 · citrix application delivery controller firmware

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.

Timeline

Detection, updates, and resolution for this record.

Dec 27, 2019 · Catalog
Detected
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 11, 2026 · Catalog
Updated
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

cpe citrix/application delivery controller firmware10.5
cpe citrix/application delivery controller firmware11.1
cpe citrix/application delivery controller firmware12.0
cpe citrix/application delivery controller firmware12.1
cpe citrix/application delivery controller firmware13.0
cpe citrix/gateway firmware13.0
cpe citrix/netscaler gateway firmware10.5
cpe citrix/netscaler gateway firmware11.1
cpe citrix/netscaler gateway firmware12.0
vendor Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Applianceversion unspecified

Sources

CISA KEVCVE-2019-19781
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
cisa.gov
CVE.orgCVE-2019-19781
Official CVE identifier
cve.org
FIRST EPSSCVE-2019-19781
30-day exploitation probability 100.0%
first.org
Exploit Database47901
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit Database47913
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit Database47930
Public archive entry. The exploit body is not stored here.
exploit-db.com
Metasploit Modulesauxiliary_scanner/http/citrix_dir_traversal
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com
Metasploit Modulesexploit_freebsd/http/citrix_dir_traversal_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDCVE-2019-19781
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
nvd.nist.gov
Packet Storm Securityhttp://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securitypacketstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securitytp://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com