CVE-2019-19781 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution

Exploited in the wild Critical 9.8 Published 27 Dec 2019 Updated 12 Aug 2026

Attackers can exploit directory traversal in Citrix ADC and Gateway to execute arbitrary code or read sensitive data.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-19781?

CVE-2019-19781 is a critical path traversal vulnerability in n/a, published on 27 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

Weakness: CWE-22

Which versions are affected by CVE-2019-19781?

It affects 3 products.

Products include Citrix Application Delivery Controller Firmware, Citrix Gateway Firmware, Citrix Netscaler Gateway Firmware.

How do I fix CVE-2019-19781?

No fix has been published for CVE-2019-19781 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-19781 being exploited?

Yes. Attackers have exploited CVE-2019-19781 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 2 Metasploit modules, 3 Exploit-DB entries, 1 Nuclei template and 44 proofs of concept on GitHub.

Sources

Also known as GHSA-jjcm-f6q3-w5xj.