Security readout for executives and security teams
Plain-English summary
Affected Citrix ADC and Gateway appliances contain a critical directory-traversal flaw reachable over a network without authentication or user interaction. Successful abuse can severely affect confidentiality, integrity, and availability. CISA lists the vulnerability as known exploited, making exposed, unremediated systems an immediate business risk.
Executive priority
Treat as immediate P1 remediation for internet-facing affected appliances. Confirm ownership, exposure, vendor-directed remediation, and compromise review. Do not consider reduced reachability equivalent to a permanent fix. Require documented verification for every affected or potentially affected instance.
Technical view
CVE-2019-19781 is CWE-22 directory traversal affecting Citrix ADC and Gateway versions 10.5, 11.1, 12.0, 12.1, and 13.0. Its CVSS 3.1 score is 9.8, with remote, low-complexity, unauthenticated access and no user interaction. The supplied evidence does not identify affected builds or remediation details.
Likely exposure
Prioritize any listed-version appliance reachable from the internet or other untrusted networks. Internal instances may also be exposed to compromised users or systems. The bundle does not establish whether every build within each named version is vulnerable, so exact builds must be checked against Citrix guidance.
Exploitation context
CISA's Known Exploited Vulnerabilities listing establishes exploitation in the wild. The supplied evidence does not establish current campaign activity, victim counts, attacker identities, or whether a specific system has been compromised. Public references also indicate substantial internet exposure was reported during the original disclosure period.
Researcher notes
The source bundle supports directory traversal, named major versions, CVSS 9.8 characteristics, and known exploitation. It does not provide affected build granularity, technical root cause, indicators, or fixed-version details. Researchers should use the vendor advisory for those specifics and avoid extrapolating beyond the documented product scope.
Mitigation direction
- Consult Citrix CTX267027 and apply its supported remediation for each deployed release immediately.
- Restrict untrusted network access to affected appliances until vendor remediation is completed and verified.
- Preserve relevant logs and begin incident response if compromise indicators or unexplained access are found.
- Track remediation exceptions with named owners and near-term completion dates.
Validation and detection
- Inventory all Citrix ADC and Gateway instances, recording exact versions, builds, and exposure paths.
- Identify instances running versions 10.5, 11.1, 12.0, 12.1, or 13.0.
- Compare each exact build and configuration with Citrix CTX267027 guidance.
- Confirm vendor-directed remediation is applied and remains effective after reboot or configuration changes.
- Review relevant appliance and access logs for suspicious traversal-related activity.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-19781 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2019-19781 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2021-11-03T00:00:00.000Z: CVE-2019-19781 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://support.citrix.com/article/CTX267027CVE reference, mitre · x_refsource_CONFIRM
- VU#619785CVE reference, mitre · third-party-advisory, x_refsource_CERT-VN
- https://twitter.com/bad_packets/status/1215431625766424576CVE reference, mitre · x_refsource_MISC
- https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/CVE reference, mitre · x_refsource_MISC
- https://forms.gle/eDf3DXZAv96oosfj6CVE reference, mitre · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19781CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.