CVE-2019-12989
Citrix SD-WAN and NetScaler SQL Injection Vulnerability
Published Jul 16, 2019 · updated Jun 16, 2026 · citrix netscaler sd-wan
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jul 16, 2019 · Catalog
Detected
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe citrix/netscaler sd-wanversion unspecified
- cpe citrix/sd-wanversion unspecified
- vendor Citrix SD-WAN and NetScalerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2019-12989
Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
cisa.gov - CVE.orgVulnerability recordCVE-2019-12989
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-12989
30-day exploitation probability 95.0%
first.org - Exploit DatabasePublic exploit reference47112
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDVulnerability recordCVE-2019-12989
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
nvd.nist.gov - Packet Storm SecurityCited reference/packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com