CVE-2019-12991: Citrix SD-WAN and NetScaler SD-WAN command injection via input validation flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a very high EPSS score and public exploit code, and successful exploitation yields full command execution on a network edge appliance.

What it is

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 fail to properly validate input, allowing OS command injection (CWE-78). The flaw is remotely reachable over the network by an authenticated low-privileged user and can lead to full compromise of the appliance.

Impact

An attacker with low-privileged credentials can execute arbitrary OS commands on the SD-WAN appliance, gaining high confidentiality, integrity and availability impact over the device.

Attack surface

Reachable over the network (AV:N) with low complexity (AC:L); it requires low privileges (PR:L) and no user interaction (UI:N). The description does not detail the exact interface or parameter involved.

Exploitation

CVE-2019-12991 is listed in CISA KEV (added 2022-03-25) and has a high EPSS 30-day probability of 0.74052 (99.458th percentile); public exploit references exist (Packet Storm, Tenable). No ransomware campaign use is documented.

What to do

• Upgrade Citrix SD-WAN to 10.2.3 or later and NetScaler SD-WAN to 10.0.8 or later per vendor advisory CTX251987.
• Restrict management and administrative access to the SD-WAN appliance to trusted networks and accounts.
• Remove or disable unused low-privileged accounts and enforce least privilege on the appliance.
• Monitor vendor advisory and CISA KEV guidance for any updated fixed versions or compensating controls.

Detection

• Review appliance and management logs for unexpected command execution or shell activity from low-privileged accounts.
• Alert on anomalous outbound connections or process spawning from the SD-WAN appliance.
• Audit authentication events for unusual logins to the SD-WAN management interface.
• Hunt for known exploit artifacts referenced in the Packet Storm and Tenable advisories against exposed SD-WAN instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.