{"id":"CVE-2019-19781","aliases":["EUVD-2019-9380","GHSA-jjcm-f6q3-w5xj"],"status":"published","title":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1,...","description":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99999,"percentile":0.99998,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2019-12-27T13:06:46Z","modified":"2026-08-12T05:17:21Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/freebsd/http/citrix_dir_traversal_rce","title":"Citrix ADC (NetScaler) Directory Traversal RCE","type":"exploit","platform":"Python,Unix","date":"2019-12-17","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/freebsd/http/citrix_dir_traversal_rce"},{"source":"pocgithub","id":"projectzeroindia/CVE-2019-19781","title":"projectzeroindia/CVE-2019-19781","date":"2020-01-10","url":"https://github.com/projectzeroindia/CVE-2019-19781"},{"source":"exploitdb","id":"EDB-47901","title":"Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution (PoC)","type":"webapps","platform":"multiple","date":"2020-01-11","url":"https://www.exploit-db.com/exploits/47901"},{"source":"pocgithub","id":"becrevex/Citrix_CVE-2019-19781","title":"becrevex/Citrix_CVE-2019-19781","date":"2020-01-11","url":"https://github.com/becrevex/Citrix_CVE-2019-19781"},{"source":"pocgithub","id":"cisagov/check-cve-2019-19781","title":"cisagov/check-cve-2019-19781","date":"2020-01-11","url":"https://github.com/cisagov/check-cve-2019-19781"},{"source":"pocgithub","id":"ianxtianxt/CVE-2019-19781","title":"ianxtianxt/CVE-2019-19781","date":"2020-01-11","url":"https://github.com/ianxtianxt/CVE-2019-19781"},{"source":"pocgithub","id":"jas502n/CVE-2019-19781","title":"jas502n/CVE-2019-19781","date":"2020-01-11","url":"https://github.com/jas502n/CVE-2019-19781"},{"source":"pocgithub","id":"mpgn/CVE-2019-19781","title":"mpgn/CVE-2019-19781","date":"2020-01-11","url":"https://github.com/mpgn/CVE-2019-19781"},{"source":"pocgithub","id":"oways/CVE-2019-19781","title":"oways/CVE-2019-19781","date":"2020-01-11","url":"https://github.com/oways/CVE-2019-19781"},{"source":"pocgithub","id":"trustedsec/cve-2019-19781","title":"trustedsec/cve-2019-19781","date":"2020-01-11","url":"https://github.com/trustedsec/cve-2019-19781"},{"source":"pocgithub","id":"unknowndevice64/Exploits_CVE-2019-19781","title":"unknowndevice64/Exploits_CVE-2019-19781","date":"2020-01-11","url":"https://github.com/unknowndevice64/Exploits_CVE-2019-19781"},{"source":"pocgithub","id":"jamesjguthrie/Shitrix-CVE-2019-19781","title":"jamesjguthrie/Shitrix-CVE-2019-19781","date":"2020-01-12","url":"https://github.com/jamesjguthrie/Shitrix-CVE-2019-19781"},{"source":"exploitdb","id":"EDB-47913","title":"Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit)","type":"webapps","platform":"multiple","date":"2020-01-13","url":"https://www.exploit-db.com/exploits/47913"},{"source":"pocgithub","id":"MalwareTech/CitrixHoneypot","title":"MalwareTech/CitrixHoneypot","date":"2020-01-13","url":"https://github.com/MalwareTech/CitrixHoneypot"},{"source":"pocgithub","id":"aqhmal/CVE-2019-19781","title":"aqhmal/CVE-2019-19781","date":"2020-01-13","url":"https://github.com/aqhmal/CVE-2019-19781"},{"source":"pocgithub","id":"hollerith/CVE-2019-19781","title":"hollerith/CVE-2019-19781","date":"2020-01-13","url":"https://github.com/hollerith/CVE-2019-19781"},{"source":"pocgithub","id":"mekhalleh/citrix_dir_traversal_rce","title":"mekhalleh/citrix_dir_traversal_rce","date":"2020-01-13","url":"https://github.com/mekhalleh/citrix_dir_traversal_rce"},{"source":"pocgithub","id":"digitalshadows/CVE-2019-19781_IOCs","title":"digitalshadows/CVE-2019-19781_IOCs","date":"2020-01-15","url":"https://github.com/digitalshadows/CVE-2019-19781_IOCs"},{"source":"pocgithub","id":"onSec-fr/CVE-2019-19781-Forensic","title":"onSec-fr/CVE-2019-19781-Forensic","date":"2020-01-15","url":"https://github.com/onSec-fr/CVE-2019-19781-Forensic"},{"source":"pocgithub","id":"zgelici/CVE-2019-19781-Checker","title":"zgelici/CVE-2019-19781-Checker","date":"2020-01-15","url":"https://github.com/zgelici/CVE-2019-19781-Checker"},{"source":"pocgithub","id":"Castaldio86/Detect-CVE-2019-19781","title":"Castaldio86/Detect-CVE-2019-19781","date":"2020-01-16","url":"https://github.com/Castaldio86/Detect-CVE-2019-19781"},{"source":"pocgithub","id":"DanielWep/CVE-NetScalerFileSystemCheck","title":"DanielWep/CVE-NetScalerFileSystemCheck","date":"2020-01-16","url":"https://github.com/DanielWep/CVE-NetScalerFileSystemCheck"},{"source":"exploitdb","id":"EDB-47930","title":"Citrix Application Delivery Controller (ADC) and Gateway 13.0 - Path Traversal","type":"webapps","platform":"multiple","date":"2020-01-16","url":"https://www.exploit-db.com/exploits/47930"},{"source":"pocgithub","id":"j81blog/ADC-19781","title":"j81blog/ADC-19781","date":"2020-01-16","url":"https://github.com/j81blog/ADC-19781"},{"source":"pocgithub","id":"awesome-security/citrixmash_scanner","title":"awesome-security/citrixmash_scanner","date":"2020-01-17","url":"https://github.com/awesome-security/citrixmash_scanner"},{"source":"pocgithub","id":"b510/CVE-2019-19781","title":"b510/CVE-2019-19781","date":"2020-01-17","url":"https://github.com/b510/CVE-2019-19781"},{"source":"pocgithub","id":"redscan/CVE-2019-19781","title":"redscan/CVE-2019-19781","date":"2020-01-17","url":"https://github.com/redscan/CVE-2019-19781"},{"source":"pocgithub","id":"citrix/ioc-scanner-CVE-2019-19781","title":"citrix/ioc-scanner-CVE-2019-19781","date":"2020-01-21","url":"https://github.com/citrix/ioc-scanner-CVE-2019-19781"},{"source":"pocgithub","id":"digitalgangst/massCitrix","title":"digitalgangst/massCitrix","date":"2020-01-21","url":"https://github.com/digitalgangst/massCitrix"},{"source":"metasploit","id":"auxiliary/scanner/http/citrix_dir_traversal","title":"Citrix ADC (NetScaler) Directory Traversal Scanner","type":"auxiliary","date":"2019-12-17","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/citrix_dir_traversal"},{"source":"nuclei","id":"CVE-2019-19781","title":"Citrix ADC and Gateway - Directory Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19781.yaml"}],"exploits_more":19,"products":[{"vendor":"citrix","product":"application delivery controller (adc), gateway, and sd-wan wanop appliance"},{"vendor":"citrix","product":"application_delivery_controller_firmware"},{"vendor":"citrix","product":"gateway_firmware"},{"vendor":"citrix","product":"netscaler_gateway_firmware"}],"references":[{"url":"https://support.citrix.com/article/CTX267027","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/619785","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://twitter.com/bad_packets/status/1215431625766424576","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory"]},{"url":"https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory"]},{"url":"https://forms.gle/eDf3DXZAv96oosfj6","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19781","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19781"},{"url":"https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781"},{"url":"https://github.com/advisories/GHSA-jjcm-f6q3-w5xj"}],"sources":{"cve":[{"id":"CVE-2019-19781","description":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.","status":"published","published":"2019-12-27T13:06:46Z","modified":"2026-08-12T03:55:42.993Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-9380","description":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.","status":"published","published":"2019-12-27T13:06:46Z","modified":"2026-08-12T03:55:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T18:01:59.11112Z"}],"ghsa":[{"id":"GHSA-jjcm-f6q3-w5xj","title":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1,...","description":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.","status":"published","published":"2022-05-24T17:05:09Z","modified":"2025-10-22T00:31:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2019-19781","title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","description":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.","cwes":["CWE-22"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2019-19781","description":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.","status":"published","published":"2019-12-27T14:15:12.07Z","modified":"2026-08-12T05:17:21.853Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:41.313583Z"}]}}