Skip to content
Back to search

CVE-2019-19781

CRITICAL
9.8 RansomwareNVD

Summary

generated automatically from NVD data

CVE-2019-19781 is a directory traversal flaw (CWE-22) in Citrix Application Delivery Controller (ADC) and Gateway, affecting versions 10.5, 11.1, 12.0, 12.1 and 13.0. It is rated CRITICAL with a CVSS v3.1 score of 9.8, and the vector shows it can be exploited over the network without authentication or user interaction, with high impact on confidentiality, integrity and availability. CISA's KEV catalog lists it as actively exploited, including use in ransomware campaigns.

NVD description

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2022-05-03

Used in known ransomware campaigns.

EPSS · FIRST.org

100.0%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

CVSS v3.1 Score

9.8
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Information

Published
27 déc. 2019
Updated
12 août 2026
Status
Analyzed
Source
cve@mitre.org

Affected products

citrix application delivery controller firmware
Versions : 10.5, 11.1, 12.0, 12.1, 13.0
citrix netscaler gateway firmware
Versions : 10.5, 11.1, 12.0, 12.1
citrix gateway firmware
Versions : 13.0

Weaknesses (CWE)

CWE-22CWE-22

References (21)

Similar CVEs

Other vulnerabilities of type CWE-22

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring