CVE-2019-19781

Confirmed PUBLISHED

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

Citrix · Application Delivery Controller and Gateway

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

malware cisa ransomware metasploit nuclei_scanner nessus_scanner

CVE Published: Dec 27, 2019
Exploitation Reported: Nov 03, 2021
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

VU#619785 kb.cert.org · Third-Party Advisory https://www.kb.cert.org/vuls/id/619785
support.citrix.com/article/CTX267027 support.citrix.com · CVE Record https://support.citrix.com/article/CTX267027
twitter.com/bad_packets/status/1215431625766424576 twitter.com · CVE Record https://twitter.com/bad_packets/status/1215431625766424576
badpackets.net/over-25000-citrix-netscaler-endpoints-vulner... badpackets.net · CVE Record https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerab...
forms.gle/eDf3DXZAv96oosfj6 forms.gle · CVE Record https://forms.gle/eDf3DXZAv96oosfj6

Show 5 more references

packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Con... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155904/Citrix-Application-Delive...
packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Con... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155930/Citrix-Application-Delive...
packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Con... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155905/Citrix-Application-Delive...
packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Dire...
packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Travers... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-T...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
The Shadowserver	2026-06-01 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19781.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Used in malware

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2020-01-10 22:56:35 UTC · GitHub

Weaknesses (CWE)

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19781.yaml	Apr 25, 2025
Nessus	https://www.tenable.com/plugins/nessus/132752	Mar 08, 2023

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

hyunjin0334/CVE-2019-19781

github · Created 2025-04-27 11:47:59 UTC · 0 stars

Whitehat school_Docker assignement_CVE-2019-19781_PoC

user20252228/CVE-2019-19781

github · Created 2025-03-16 17:58:09 UTC · 0 stars

RCE, Citirx ADC and Gateway Directory Traversal

zerobytesecure/CVE-2019-19781

github · Created 2024-06-25 21:02:16 UTC · 0 stars

k-fire/CVE-2019-19781-exploit

github · Created 2021-09-27 02:23:02 UTC · 2 stars

CVE-2019-19781

Vulnmachines/Ctirix_RCE-CVE-2019-19781

github · Created 2021-08-29 05:22:47 UTC · 1 stars

Citrix ADC RCE cve-2019-19781

pwn3z/CVE-2019-19781-Citrix

github · Created 2021-04-06 05:24:59 UTC · 0 stars

VladRico/CVE-2019-19781

github · Created 2020-07-30 17:37:40 UTC · 7 stars

Shitrix : CVE-2019-19781 - Remote Code Execution on Citrix ADC Netscaler exploit

andripwn/CVE-2019-19781

github · Created 2020-07-27 15:09:51 UTC · 1 stars

Citrix ADC scanner (CVE-2019-19781) using hosts retrieved from Shodan API.

w4fz5uck5/CVE-2019-19781-CitrixRCE

github · Created 2020-07-17 11:52:36 UTC · 10 stars

Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-19781

SharpHack/CVE-2019-19781

github · Created 2020-07-09 05:17:07 UTC · 0 stars

yukar1z0e/CVE-2019-19781

github · Created 2020-05-26 08:00:22 UTC · 0 stars

r4ulcl/CVE-2019-19781

github · Created 2020-01-28 12:09:51 UTC · 1 stars

Python CVE-2019-19781 exploit

citrix/ioc-scanner-CVE-2019-19781

github · Created 2020-01-21 23:13:00 UTC · 58 stars

Indicator of Compromise Scanner for CVE-2019-19781

mandiant/ioc-scanner-CVE-2019-19781

github · Created 2020-01-21 15:20:25 UTC · 94 stars

Indicator of Compromise Scanner for CVE-2019-19781

redscan/CVE-2019-19781

github · Created 2020-01-17 16:14:30 UTC · 1 stars

CVE-2019-19781 Attack Triage Script

b510/CVE-2019-19781

github · Created 2020-01-17 06:09:18 UTC · 0 stars

批量概念驗證用

onSec-fr/CVE-2019-19781-Forensic

github · Created 2020-01-15 20:43:37 UTC · 5 stars

Automated forensic script hunting for cve-2019-19781

aqhmal/CVE-2019-19781

github · Created 2020-01-13 07:42:27 UTC · 9 stars

Automated script for Citrix ADC scanner (CVE-2019-19781) using hosts retrieved from Shodan API. You must have a Shodan account to use this script.

hollerith/CVE-2019-19781

github · Created 2020-01-13 02:14:59 UTC · 0 stars

Citrix Netscaler RCE

haxrob/CVE-2019-19781

github · Created 2020-01-12 23:13:56 UTC · 45 stars

DFIR notes for Citrix ADC (NetScaler) appliances vulnerable to CVE-2019-19781

unknowndevice64/Exploits_CVE-2019-19781

github · Created 2020-01-11 20:43:09 UTC · 3 stars

All Working Exploits

oways/CVE-2019-19781

github · Created 2020-01-11 13:05:28 UTC · 2 stars

CVE-2019-19781 Citrix RCE

mpgn/CVE-2019-19781

github · Created 2020-01-11 09:49:17 UTC · 156 stars

CVE-2019-19781 - Remote Code Execution on Citrix ADC Netscaler exploit

ianxtianxt/CVE-2019-19781

github · Created 2020-01-11 07:16:23 UTC · 7 stars

Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway [ CVE-2019-19781 ]

jas502n/CVE-2019-19781

github · Created 2020-01-11 03:10:12 UTC · 83 stars

Citrix ADC Remote Code Execution

projectzeroindia/CVE-2019-19781

github · Created 2020-01-10 22:56:35 UTC · 370 stars

Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway [ CVE-2019-19781 ]

Citrix ADC and Gateway - Directory Traversal

nuclei · Created Unknown

citrix_dir_traversal_rce

metasploit · Created Unknown

Metasploit module for CVE-2019-19781

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
8 Mar 2023 01:05 UTC over 3 years ago

8 Mar 2023 01:05 UTC · over 3 years ago

Nessus plugin available

Scanner coverage available
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

First public exploitation report

Exploit observed in malware
10 Jan 2020 22:56 UTC over 6 years ago

10 Jan 2020 22:56 UTC · over 6 years ago

Public PoC available

Public proof-of-concept code published
27 Dec 2019 13:06 UTC over 6 years ago

27 Dec 2019 13:06 UTC · over 6 years ago

CVE published

Vulnerability disclosed publicly
13 Dec 2019 00:00 UTC over 6 years ago

13 Dec 2019 00:00 UTC · over 6 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2019-19781

{
  "cve_id": "CVE-2019-19781",
  "title": "An issue was discovered in Citrix Application Delivery Controller (ADC) and G...",
  "affected_vendor": "Citrix",
  "affected_product": "Application Delivery Controller and Gateway",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99999,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2019-19781

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API