{"id":"CVE-2019-19781","kind":"vulnerability","aliases":["CVE-2019-19781"],"related":[],"title":"Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","description":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Citrix ADC, Citrix Gateway, and Citrix SD-WAN WANOP appliances contain an unspecified flaw that lets an unauthenticated attacker run code on the device. CISA lists it as actively exploited in the wild and tied to ransomware campaigns.","severity":"critical","cvss":9.8,"epss":0.99999,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix","citrix-adc","citrix-gateway","exploited","infrastructure","ransomware","sd-wan-wanop","self-hosted"],"not_affected_if":["unaffected-model-or-build"],"how_to_check":"Check the appliance firmware or build version against the Citrix advisory for CVE-2019-19781; the sources do not give a version command.","fix":"Apply the Citrix vendor update for the affected ADC, Gateway, or SD-WAN WANOP build (CISA: 'Apply updates per vendor instructions'); specific fixed versions are not in the sources.","status":"open","published_at":"2019-12-27T14:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:46+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:33:46Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Citrix vendor update for the affected ADC, Gateway, or SD-WAN WANOP build (CISA: 'Apply updates per vendor instructions'); specific fixed versions are not in the sources.","reach":"internet","impact":"high","summary":"Citrix ADC, Citrix Gateway, and Citrix SD-WAN WANOP appliances contain an unspecified flaw that lets an unauthenticated attacker run code on the device. CISA lists it as actively exploited in the wild and tied to ransomware campaigns.","category":"infrastructure","who_cares":["citrix","citrix-adc","citrix-gateway","sd-wan-wanop","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the appliance, likely taking over the gateway.","analyst_note":"Find the affected firmware versions and fixed builds in the Citrix security bulletin for CVE-2019-19781 and add a version check command.","how_to_check":"Check the appliance firmware or build version against the Citrix advisory for CVE-2019-19781; the sources do not give a version command.\nunknown","needs_analyst":true,"not_affected_if":["unaffected-model-or-build"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000529,"input_tokens":2932,"output_tokens":472,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-19781':27A,30A '-2019':26A,29A 'action':128C 'activ':89B 'adc':5A,14A,35A,46B,61B,100C 'allow':118C 'and':37A 'appli':129C 'applianc':12A,21A,70B,110C 'appliance':42A 'applic':2A 'application':32A 'attack':79B,121C 'campaign':98B 'cisa':85B,126C 'citrix':1A,13A,31A,43B,45B,48B,60B,62B,65B,99C,101C,105C 'citrix-adc':44B 'citrix-gateway':47B 'code':22A,81B,124C 'contain':71B,112C 'control':4A 'controller':34A 'could':117C 'cve':25A,28A 'deliveri':3A 'delivery':33A 'devic':84B 'execut':23A,125C 'exploit':50B,90B 'flaw':74B 'gateway':6A,15A,36A,49B,63B,102C 'host':59B 'infrastructur':51B 'instruct':133C 'let':76B 'list':86B 'model':111C 'multipl':104C 'per':131C 'perform':123C 'ransomwar':52B,97B 'requir':127C 'run':80B 'sd':9A,18A,39A,54B,67B,107C 'sd-wan':8A,17A,38A,66B,106C 'sd-wan-wanop':53B 'self':58B 'self-host':57B 'tie':95B 'unauthent':78B,120C 'unspecifi':73B,114C 'updat':130C 'vendor':132C 'vulner':24A,115C 'wan':10A,19A,40A,55B,68B,108C 'wanop':11A,20A,41A,56B,69B,109C 'wild':93B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-27T14:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-19781","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-19781","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2019-19781","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-19781","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-19781","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19781","severity":null,"published_at":"2019-12-27T14:15:12+00:00","modified_at":"2026-08-12T05:17:21+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}