CVE-2019-19781
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Nov 3, 2021
- US federal agencies must remediate it by May 3, 2022 (BOD 22-01)
- First attack observed 19 days after disclosure
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Apply updates per vendor instructions.
Source: CISA KEV · Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Sep 30, 2026 Sep 29, 2026 Sep 28, 2026
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-22, CWE-22
Vendorscitrix
Affected products
| Vendors | Product | Versions |
|---|---|---|
| citrix | application delivery controller firmware | 10.5 |
| citrix | application delivery controller | - |
| citrix | netscaler gateway firmware | 10.5 |
| citrix | netscaler gateway | - |
| citrix | gateway firmware | 13.0 |
| citrix | gateway | - |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.