CVE-2019-12991
Citrix SD-WAN and NetScaler Command Injection Vulnerability
Published Jul 16, 2019 · updated Jun 16, 2026 · citrix netscaler sd-wan
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jul 16, 2019 · Catalog
Detected
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe citrix/netscaler sd-wanversion unspecified
- cpe citrix/sd-wanversion unspecified
- vendor Citrix SD-WAN and NetScalerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2019-12991
Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
cisa.gov - CVE.orgVulnerability recordCVE-2019-12991
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-12991
30-day exploitation probability 74.1%
first.org - Exploit DatabasePublic exploit reference47112
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDVulnerability recordCVE-2019-12991
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
nvd.nist.gov - Packet Storm SecurityCited reference/packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com