CVE-2019-12989 Citrix SD-WAN and NetScaler SQL Injection

Exploited in the wild Critical 9.8 Published 16 Jul 2019 Updated 21 Oct 2025

Attackers can inject SQL commands into Citrix SD-WAN appliances to read or modify database contents.

Exploited in the wild: Since 25 Mar 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-12989?

CVE-2019-12989 is a critical SQL injection vulnerability in n/a, published on 16 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

Weakness: CWE-89

Which versions are affected by CVE-2019-12989?

It affects 2 products.

Products include Citrix Netscaler Sd-Wan, Citrix Sd-Wan.

How do I fix CVE-2019-12989?

No fix has been published for CVE-2019-12989 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Apr 2022.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2019-12989 being exploited?

Yes. Attackers have exploited CVE-2019-12989 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.

Sources

Also known as GHSA-9q4p-22w8-h32x.