CVE-2019-12991 Citrix SD-WAN and NetScaler Command Injection

Exploited in the wild High 8.8 Published 16 Jul 2019 Updated 21 Oct 2025

Attackers can execute arbitrary commands on Citrix SD-WAN devices due to improper input validation, requiring an upgrade to secure versions.

Exploited in the wild: Since 25 Mar 2022
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-12991?

CVE-2019-12991 is a high-severity command injection vulnerability in n/a, published on 16 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).

Weakness: CWE-78

Which versions are affected by CVE-2019-12991?

It affects 2 products.

Products include Citrix Netscaler Sd-Wan, Citrix Sd-Wan.

How do I fix CVE-2019-12991?

No fix has been published for CVE-2019-12991 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Apr 2022.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-12991 being exploited?

Yes. Attackers have exploited CVE-2019-12991 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-462p-6gjx-6wj6.