CVE-2019-12991VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2019-12991: Citrix SD-WAN and NetScaler Command Injection Vulnerability

Affects Citrix SD-WAN and NetScalerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 74.5% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-12991 (opens in a new tab)

Description

CVE-2019-12991 is an authenticated command injection vulnerability affecting Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. This vulnerability allows an authenticated attacker to execute arbitrary commands on the affected devices. It has been exploited in the wild, indicating active threat activity. The severity is assessed as high due to the potential impact of command injection on critical network infrastructure.

Summary

CVE-2019-12991 is an authenticated command injection vulnerability in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. The flaw allows attackers with valid credentials to inject and execute arbitrary commands on the affected systems. This vulnerability has been observed to be exploited in the wild, highlighting its real-world risk. No specific affected versions or patch information is provided in the available data. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Impact

Successful exploitation of this vulnerability enables an authenticated attacker to execute arbitrary commands on the affected Citrix SD-WAN and NetScaler appliances. This can lead to unauthorized control over the device, potentially compromising network traffic, device integrity, and confidentiality. Given the role of these appliances in network management, exploitation could have significant operational impact.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interfaces of affected appliances to trusted administrators only and monitor for unusual activity. Follow Citrix's official security advisories for updates and apply patches promptly once released.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:10:25 UTC

Weaknesses

References

Related threats