CVE-2019-19781

ENISA EUVD: EUVD-2019-9380 ↗

Exploited in the Wild ✓ Confirmed 0-Day

Triaged: March 5, 2026 14 articles

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

94.44%

probability

This CVE has a 94.44% probability of being exploited in the next 30 days.

0% Top 100.0th percentile of all CVEs 100%

CVSS v3.1

Source: NVD

9.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Attack Intelligence

CWE-22 · Path Traversal CWE-664 · Improper Control of a Resource Through its Lifetime CWE-706 · Use of Incorrectly-Resolved Name or Reference

Exploits & PoC

trustedsec/cve-2019-19781

This is a tool published for the Citrix ADC (NetScaler) vulnerability. We are only disclosing this due to others publishing the exploit code first.

572

projectzeroindia/CVE-2019-19781

Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway [ CVE-2019-19781 ]

368

mpgn/CVE-2019-19781

CVE-2019-19781 - Remote Code Execution on Citrix ADC Netscaler exploit

160

MalwareTech/CitrixHoneypot

Detect and log CVE-2019-19781 scan and exploitation attempts.

119

cisagov/check-cve-2019-19781

Test a host for susceptibility to CVE-2019-19781

109

mandiant/ioc-scanner-CVE-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781

jas502n/CVE-2019-19781

Citrix ADC Remote Code Execution

citrix/ioc-scanner-CVE-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781

aqhmal/CVE-2019-19781

Automated script for Citrix ADC scanner (CVE-2019-19781) using hosts retrieved from Shodan API. You must have a Shodan account to use this script.

w4fz5uck5/CVE-2019-19781-CitrixRCE

Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-19781

10 repos — triés par ⭐ Rechercher sur GitHub ↗

Part 2: An In-Depth Look at the Latest Vulnerability Threat Landscape (Attackers’ Edition)

Qualys Jul 18, 2023

Qualys Top 20 Most Exploited Vulnerabilities

Qualys Sep 04, 2023

Hackers exploit critical Citrix ADC and Gateway zero day, patch now

BleepingComputer Dec 13, 2022

Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations

Qualys May 08, 2025

NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

Qualys Oct 07, 2022

SonicWall firewall maker hacked using zero-day in its VPN device

BleepingComputer Jan 23, 2021

Citrix Releases Patches for Critical ADC Vulnerability Under Active Attack

TheHackerNews

A Patient Dies After Ransomware Attack Paralyzes German Hospital Systems

TheHackerNews

Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach

Qualys Dec 10, 2020

Top 12 Security Flaws Russian Spy Hackers Are Exploiting in the Wild

TheHackerNews

Top 30 Critical Security Vulnerabilities Most Exploited by Hackers

TheHackerNews

CISA Alert: Top Routinely Exploited Vulnerabilities

Qualys Jul 29, 2021

Nefilim Ransomware

Qualys May 12, 2021

Security Advisory 2020-002

CERT-EU Jan 13, 2020

Signal Intelligence

Confidenceⓘ

85%

EPSS 94.44%

CVSS v3.1 9.8

Mentions 14

Last Seen May 08, 2025

CNA Information

Analyst Note

CVE-2019-19781 is a critical Citrix ADC/Gateway directory traversal vulnerability (CVSS 9.8) published 2019-12-27. CERT-EU issued a security advisory in early 2020 labeling it critical, and this vulnerability became widely exploited in the wild shortly after disclosure, before patches were fully available across deployments. The rapid exploitation and critical severity align with zero-day characteristics, though specific timing confirmation is limited by available article excerpts.