{"id":"CVE-2019-12991","kind":"vulnerability","aliases":["CVE-2019-12991"],"related":[],"title":"Citrix SD-WAN and NetScaler: Citrix SD-WAN and NetScaler Command Injection Vulnerability","description":"Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Citrix SD-WAN and NetScaler SD-WAN appliances contain a command injection flaw that lets an authenticated user run operating system commands on the device. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attackers are using it in the wild.","severity":"critical","cvss":9.0,"epss":0.7446,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Citrix SD-WAN and NetScaler","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix","exploited","infrastructure","netscaler","sd-wan","self-hosted"],"not_affected_if":["no-authenticated-access-exposed","not-citrix-sd-wan"],"how_to_check":null,"fix":"Apply the updates per Citrix vendor instructions; the specific fixed version is unknown from these sources.","status":"open","published_at":"2019-07-16T18:15:13+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:10+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:20:10Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per Citrix vendor instructions; the specific fixed version is unknown from these sources.","reach":"network","impact":"high","summary":"Citrix SD-WAN and NetScaler SD-WAN appliances contain a command injection flaw that lets an authenticated user run operating system commands on the device. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attackers are using it in the wild.","category":"infrastructure","who_cares":["citrix","netscaler","sd-wan","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"authenticated user runs arbitrary OS commands on the appliance","analyst_note":"Find the affected and fixed versions and the Citrix advisory for CVE-2019-12991 to fill in how_to_check and fix; the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-citrix-sd-wan","no-authenticated-access-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000478,"input_tokens":2841,"output_tokens":388,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-12991':18A,21A '-2019':17A,20A 'action':100C 'and':26A 'appli':101C 'applianc':47B,91C,97C 'attack':76B 'authent':56B,83C 'catalog':74B 'cisa':69B,98C 'citrix':1A,7A,22A,28B,38B,87C 'command':13A,50B,61B,84C 'contain':48B 'cve':16A,19A 'devic':64B 'exploit':29B,72B 'flaw':52B 'host':37B 'infrastructur':30B 'inject':14A,51B,85C 'instruct':105C 'known':71B 'let':54B 'list':67B 'netscal':6A,12A,31B,43B,93C 'netscaler':27A 'oper':59B 'per':103C 'requir':99C 'run':58B 'sd':3A,9A,24A,33B,40B,45B,89C,95C 'sd-wan':2A,8A,23A,32B,39B,44B,88C,94C 'self':36B 'self-host':35B 'system':60B 'updat':102C 'use':78B 'user':57B 'vendor':104C 'vulner':15A,73B 'wan':4A,10A,25A,34B,41B,46B,90C,96C 'wild':82B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-07-16T18:15:13+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-12991","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-12991","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:36+00:00","note":null},{"source":"epss","external_id":"CVE-2019-12991","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-12991","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-12991","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12991","severity":null,"published_at":"2019-07-16T18:15:13+00:00","modified_at":"2026-06-17T02:15:52+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}