Detections
Analytics

CVE-2019-19781

critical

Description

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

From the Tenable Blog

CVE-2019-19781: Critical Vulnerability in Citrix ADC and Gateway Sees Active Exploitation While Patches are Still Not Available
CVE-2019-19781: Critical Vulnerability in Citrix ADC and Gateway Sees Active Exploitation While Patches are Still Not Available

Published: 2020-01-17

Following the release of exploit scripts for a critical flaw in Citrix Application Delivery Controller (ADC) and Gateway, attackers launch attacks against vulnerable hosts, while Citrix announces release date for patches UPDATE 01/24/2020: This blog post has been updated to reflect the availability of patches released by Citrix. Background Attacks Increase After Exploit Scripts Released

CVE-2019-19781: Exploit Scripts for Remote Code Execution Vulnerability in Citrix ADC and Gateway Available
CVE-2019-19781: Exploit Scripts for Remote Code Execution Vulnerability in Citrix ADC and Gateway Available

Published: 2020-01-11

Attackers are actively probing for vulnerable Citrix Application Delivery Controller (ADC) and Gateway hosts, while multiple proof-of-concept scripts are released, emphasizing the importance of mitigating this flaw immediately.

CVE-2019-19781: Unauthenticated Remote Code Execution Vulnerability in Citrix ADCs and Gateways
CVE-2019-19781: Unauthenticated Remote Code Execution Vulnerability in Citrix ADCs and Gateways

Published: 2019-12-23

Citrix urges customers to apply mitigation steps for CVE-2019-19781, a remote code execution vulnerability exploitable through specially crafted HTTP requests to vulnerable devices.

References

https://www.kb.cert.org/vuls/id/619785

https://forms.gle/eDf3DXZAv96oosfj6

http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html

http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html

http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html

http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html

http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html

https://www.theregister.com/security/2026/08/27/fbi-seizes-hacking-tools-it-says-china-used-to-attack-nasa-doe-us-senate-and-other-critical-networks/5292742

https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a

https://www.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report

https://www.tenable.com/cyber-exposure/a-look-inside-the-ransomware-ecosystem

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a

https://www.tenable.com/cyber-exposure/2021-threat-landscape-retrospective

https://web.archive.org/web/20211025233339/https://twitter.com/pancak3lullz/status/1452679527197560837

https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-296a

https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-133a

https://www.bleepingcomputer.com/news/security/citrix-releases-final-patch-as-ransomware-attacks-ramp-up/

https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf

https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions

https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf

https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign-using-multiple-exploits

https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html

https://www.mandiant.com/resources/blog/nice-try-501-ransomware-not-implemented

https://www.tenable.com/blog/cve-2025-7775-citrix-netscaler-adc-and-netscaler-gateway-zero-day-remote-code-execution

https://www.tenable.com/blog/frequently-asked-questions-about-iranian-cyber-operations

https://www.tenable.com/blog/from-bugs-to-breaches-25-significant-cves-as-mitre-cve-turns-25

https://www.tenable.com/blog/aa24-241a-joint-cybersecurity-advisory-on-iran-based-cyber-actors-targeting-us-organizations

https://www.tenable.com/blog/cve-2023-4966-citrix-netscaler-adc-and-netscaler-gateway-information-disclosure-exploited-in

https://www.tenable.com/blog/aa23-215a-2022s-top-routinely-exploited-vulnerabilities

https://www.tenable.com/blog/cve-2023-3519-critical-rce-in-netscaler-adc-citrix-adc-and-netscaler-gateway-citrix-gateway

https://www.tenable.com/blog/cisa-top-20-cves-exploited-peoples-republic-of-china-state-sponsored-actors-aa22-279a

https://www.tenable.com/blog/government-advisories-warn-of-apt-activity-resulting-from-russian-invasion-of-ukraine

https://www.tenable.com/blog/examining-the-treat-landscape

https://www.tenable.com/blog/one-year-later-what-can-we-learn-from-zerologon

https://www.tenable.com/blog/healthcare-security-ransomware-plays-a-prominent-role-in-covid-19-era-breaches

https://www.tenable.com/blog/cve-2021-21972-vmware-vcenter-server-remote-code-execution-vulnerability

https://www.tenable.com/blog/government-agencies-warn-of-state-sponsored-actors-exploiting-publicly-known-vulnerabilities

https://www.tenable.com/blog/cve-2020-5135-critical-sonicwall-vpn-portal-stack-based-buffer-overflow-vulnerability

https://www.tenable.com/blog/us-cybersecurity-agency-cisa-alert-foreign-threat-actors-target-unpatched-vulnerabilities

https://www.tenable.com/blog/cve-2019-19781-critical-vulnerability-in-citrix-adc-and-gateway-sees-active-exploitation-while

https://www.tenable.com/blog/cve-2020-3452-cisco-adaptive-security-appliance-and-firepower-threat-defense-path-traversal

https://www.tenable.com/blog/cve-2020-2021-palo-alto-networks-pan-os-vulnerable-to-critical-authentication-bypass

https://www.tenable.com/blog/critical-vulnerabilities-you-need-to-find-and-fix-to-protect-the-remote-workforce

https://www.tenable.com/blog/how-covid-19-response-is-expanding-the-cyberattack-surface

https://www.tenable.com/blog/cve-2019-19781-unauthenticated-remote-code-execution-vulnerability-in-citrix-adcs-and-gateways

https://github.com/chengbochuan3/CVE-Network-Device

https://github.com/enjoylife96962930-a11y/bug-bounty-series-2026

https://github.com/Lanexus/cve-scanner

https://github.com/MohammedAbdulAhadSaud/DotSlash

https://github.com/ericrihm/edge-security-ground-truth

https://github.com/flags-alt/abyss-c2

https://github.com/cyber-green/CVE_REPORT_2026

https://github.com/THU-HJY/CVE-Honeypot

https://github.com/hakimkt/CitrixScope-Citrix-Vulnerability-Intelligence-Scanner

https://github.com/J3ff-R3y/network-scanner-cmdb

https://github.com/hermestoola/bb-hunter-pro

https://github.com/autocode07/cisagov__check-cve-2019-19781.4142e02b

https://github.com/pondoksiber/Catatan_CVE

https://github.com/hyunjin0334/CVE-2019-19781

https://github.com/citrixgitoff/-ioc-scanner-CVE-2019-19781

https://github.com/zerobytesecure/CVE-2019-19781

https://github.com/0xget/cve-2001-1473

https://github.com/34zY/APT-Backpack

https://github.com/k-fire/CVE-2019-19781-exploit

https://github.com/Vulnmachines/Ctirix_RCE-CVE-2019-19781

https://github.com/andripwn/CVE-2019-19781

https://github.com/w4fz5uck5/CVE-2019-19781-CitrixRCE

https://github.com/Roshi99/Remote-Code-Execution-Exploit-for-Citrix-Application-Delivery-Controller-and-Citrix-Gateway-CVE-201

https://github.com/nmanzi/webcvescanner

https://github.com/r4ulcl/CVE-2019-19781

https://github.com/RaulCalvoLaorden/CVE-2019-19781

https://github.com/0xams/citrixvulncheck

https://github.com/Azeemering/CVE-2019-19781-DFIR-Notes

https://github.com/L4r1k/CitrixNetscalerAnalysis

https://github.com/x1sec/citrix-honeypot

https://github.com/robhax/citrix-honeypot

https://github.com/citrix/ioc-scanner-CVE-2019-19781

https://github.com/mandiant/ioc-scanner-CVE-2019-19781

https://github.com/digitalgangst/massCitrix

https://github.com/ynsmroztas/citrix.sh

https://github.com/redscan/CVE-2019-19781

https://github.com/LeapBeyond/cve_2019_19781

https://github.com/j81blog/ADC-19781

https://github.com/DanielWep/CVE-NetScalerFileSystemCheck

https://github.com/digitalshadows/CVE-2019-19781_IOCs

https://github.com/zgelici/CVE-2019-19781-Checker

https://github.com/mekhalleh/citrix_dir_traversal_rce

https://github.com/MalwareTech/CitrixHoneypot

https://github.com/aqhmal/CVE-2019-19781

https://github.com/x1sec/CVE-2019-19781

https://github.com/robhax/CVE-2019-19781

https://github.com/jamesjguthrie/Shitrix-CVE-2019-19781

https://github.com/JamesG-Zero/Shitrix-CVE-2019-19781

https://github.com/x1sec/citrixmash_scanner

https://github.com/robhax/citrixmash_scanner

https://github.com/becrevex/Citrix_CVE-2019-19781

https://github.com/oways/CVE-2019-19781

https://github.com/mpgn/CVE-2019-19781

https://github.com/ianxtianxt/CVE-2019-19781

https://github.com/cisagov/check-cve-2019-19781

https://github.com/projectzeroindia/CVE-2019-19781

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19781

https://twitter.com/bad_packets/status/1215431625766424576

https://support.citrix.com/article/CTX267027

https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/

Details

Source: Mitre, NVD

Published: 2019-12-27

Updated: 2026-08-12

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.99999

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Concern