9.8Kritisch KEV In Ransomware genutzt

CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

citrix application delivery controller firmware; citrix netscaler gateway firmware; citrix gateway firmware Veröffentlicht: 2019-12-27 16:06 (vor 6 Jahren)

Bekannt ausgenutzt — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-19781

Beschreibung

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

Schwachstellentyp (CWE): CWE-22

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
citrix	application delivery controller firmware	10.5
citrix	gateway firmware	13.0
citrix	netscaler gateway firmware	10.5

Referenzen und Patches

https://support.citrix.com/article/CTX267027 Vendor Advisory
VU#619785 third-party-advisoryThird Party AdvisoryUS Government Resource
https://twitter.com/bad_packets/status/1215431625766424576 Broken LinkThird Party Advisory
https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/ Broken LinkThird Party Advisory
https://forms.gle/eDf3DXZAv96oosfj6 Third Party Advisory
http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execut… Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-E… Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execut… Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html Third Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19781 US Government Resource

CPE-Treffer (NVD) (10)

cpe:2.3:o:citrix:application_delivery_controller_firmware:10.5:*:*:*:*:*:*:*
cpe:2.3:o:citrix:application_delivery_controller_firmware:11.1:*:*:*:*:*:*:*
cpe:2.3:o:citrix:application_delivery_controller_firmware:12.0:*:*:*:*:*:*:*
cpe:2.3:o:citrix:application_delivery_controller_firmware:12.1:*:*:*:*:*:*:*
cpe:2.3:o:citrix:application_delivery_controller_firmware:13.0:*:*:*:*:*:*:*
cpe:2.3:o:citrix:netscaler_gateway_firmware:10.5:*:*:*:*:*:*:*
cpe:2.3:o:citrix:netscaler_gateway_firmware:11.1:*:*:*:*:*:*:*
cpe:2.3:o:citrix:netscaler_gateway_firmware:12.0:*:*:*:*:*:*:*
cpe:2.3:o:citrix:netscaler_gateway_firmware:12.1:*:*:*:*:*:*:*
cpe:2.3:o:citrix:gateway_firmware:13.0:*:*:*:*:*:*:*

CVSS-Score

9.8Kritisch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	9.8Kritisch
nvd	CVSS 3.1	9.8Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritisch
nvd	CVSS 2.0	7.5Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

100.00%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2019-12-13
Veröffentlicht2019-12-27 16:06
Bei IP-DB eingegangen2026-10-24 23:34
In KEV aufgenommen2021-11-03
Zuletzt aktualisiert2026-08-12 08:17

Vergeben von (CNA): mitre
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Citrix NetScaler ADC / Gateway

9.5Kritisch

CVE-2026-107406 vor 1 Monat

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

NetScaler ADC; NetScaler Gateway

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: …

1.9%EPSS

8.7Hoch

CVE-2026-88779 KEV vor 1 Monat

Memory overflow vulnerability leading to Denial of Service

NetScaler ADC; NetScaler Gateway

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

11%EPSS

8.8Hoch

CVE-2026-88778 vor 1 Monat

TCP Initial Sequence Number (ISN) prediction

Citrix NetScaler ADC; Citrix NetScaler Gateway

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1…

8.8Hoch

CVE-2026-88777 vor 1 Monat

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Citrix NetScaler ADC; Citrix NetScaler Gateway

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and befo…

8.8Hoch

CVE-2026-88776 vor 1 Monat

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Citrix NetScaler ADC; Citrix NetScaler Gateway

8.8Hoch

CVE-2026-88775 vor 1 Monat

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Citrix NetScaler ADC; Citrix NetScaler Gateway

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 …