CVE-2019-12992: Citrix SD-WAN and NetScaler SD-WAN command injection via improper input validation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability, low privileges and high impact, plus an exploit-tagged reference and very high EPSS, though no KEV listing or confirmed in-the-wild use is documented.

What it is

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 fail to properly validate input, mapped to CWE-78 OS command injection (issue 6 of 6 in the advisory). A low-privileged authenticated attacker can inject commands that execute on the appliance, which matters because these devices sit on the network edge and often hold configuration and credential material.

Impact

An attacker with low privileges gains high confidentiality, integrity and availability impact on the appliance, meaning command execution in the device context, potential access to stored configuration and secrets, and ability to disrupt or alter SD-WAN traffic handling.

Attack surface

Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), so any authenticated low-privileged account on the management interface is enough. No public detail in the record identifies the exact vulnerable parameter or endpoint.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but a Tenable research reference is tagged Exploit and EPSS is 0.4894 (98.8th percentile), indicating meaningful and elevated likelihood of exploitation activity.

What to do

• Upgrade Citrix SD-WAN to 10.2.3 or later and NetScaler SD-WAN to 10.0.8 or later per vendor advisory CTX251987.
• Restrict management interface access to trusted networks and disable or limit low-privileged accounts on the appliances.
• Rotate credentials and secrets stored on or managed by affected appliances after patching.
• Monitor vendor advisory CTX251987 and Tenable TRA-2019-31 for updated guidance and any revised fixed versions.

Detection

• Alert on unexpected child processes or shell invocations spawned by the SD-WAN management/web service.
• Review appliance and management logs for anomalous authenticated sessions, especially from low-privileged accounts, and for command-like strings in request parameters.
• Baseline and monitor outbound connections from SD-WAN appliances for signs of post-exploitation activity.
• Track authentication and configuration-change events on the management interface for unusual timing or source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.