CVE-2019-12991

HIGH8.8

CISA KEV

Published 2019-07-16 · Updated 2026-06-17 · Source cve@mitre.org

Summary

CVE-2019-12991 is a high-severity (CVSS 8.8) vulnerability in Citrix SD-WAN and NetScaler. CISA added it to the Known Exploited Vulnerabilities catalog on March 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 15, 2022. CISA does not currently list it as used in ransomware campaigns. Citrix has 27 vulnerabilities in the KEV catalog, 7 of them linked to ransomware.

All 27 known-exploited Citrix vulnerabilities →

Description

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-78CWE-78

CISA Known-Exploited Vulnerability

Product: Citrix — SD-WAN and NetScaler

Name: Citrix SD-WAN and NetScaler Command Injection Vulnerability

Date added: 2022-03-25 · Due: 2022-04-15

Required action: Apply updates per vendor instructions.

References

View on NVD

More exploited Citrix vulnerabilities

Most recently added to CISA KEV

CVE-2026-88779
NetScaler — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
added 2026-10-04
CVE-2026-88772
NetScaler — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
added 2026-09-27
CVE-2026-88771
NetScaler — Citrix NetScaler Improper Input Validation Vulnerability
added 2026-09-27
CVE-2026-19490
NetScaler — Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
added 2026-09-09
CVE-2026-8452
NetScaler ADC and NetScaler Gateway — Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
added 2026-08-26
CVE-2026-3055
NetScaler — Citrix NetScaler Out-of-Bounds Read Vulnerability
added 2026-03-30

View all →

Related CVEs

Same severity, most recent

CVE-2026-75590
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.
2026-11-07 · score 7.2
CVE-2026-19128
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
2026-11-07 · score 7.5
CVE-2026-19121
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
2026-11-07 · score 8.3
CVE-2026-17411
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
2026-11-07 · score 7.6
CVE-2026-17407
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
2026-11-07 · score 8.5