---
id: "CVE-2019-12991"
kind: "vulnerability"
aliases: ["CVE-2019-12991"]
title: "Citrix SD-WAN and NetScaler: Citrix SD-WAN and NetScaler Command Injection Vulnerability"
severity: "critical"
cvss: 9.0
epss: 0.7446
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Citrix SD-WAN and NetScaler", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["citrix", "exploited", "infrastructure", "netscaler", "sd-wan", "self-hosted"]
not_affected_if: ["no-authenticated-access-exposed", "not-citrix-sd-wan"]
published_at: "2019-07-16T18:15:13+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-12991", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12991", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12991", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Citrix SD-WAN and NetScaler: Citrix SD-WAN and NetScaler Command Injection Vulnerability

Citrix SD-WAN and NetScaler SD-WAN appliances contain a command injection flaw that lets an authenticated user run operating system commands on the device. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attackers are using it in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Citrix SD-WAN and NetScaler affected ? fixed ?

## Fix

Apply the updates per Citrix vendor instructions; the specific fixed version is unknown from these sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-12991
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-12991
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-12991

## From the sources

Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_