PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-19781 Citrix CVE debrief

CVE-2019-19781 is a Citrix code execution vulnerability affecting Citrix ADC, Gateway, and SD-WAN WANOP Appliance. CISA classifies it as a Known Exploited Vulnerability and notes known ransomware campaign use, so defenders should treat remediation as urgent.

Vendor
Citrix
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2021-11-03
Original CVE updated
2021-11-03
Advisory published
2021-11-03
Advisory updated
2021-11-03

Who should care

Teams that own, operate, or patch Citrix ADC, Citrix Gateway, or Citrix SD-WAN WANOP appliances should prioritize this CVE immediately, especially where these appliances are part of critical access or delivery infrastructure.

Technical summary

The supplied official records describe CVE-2019-19781 as a code execution vulnerability in Citrix ADC, Gateway, and SD-WAN WANOP Appliance. The CISA KEV entry marks it as known exploited and records known ransomware campaign use. The corpus does not provide a CVSS score, so priority should be driven by exploitation status and vendor remediation guidance rather than severity scoring alone.

Defensive priority

Urgent. CISA has added this CVE to the Known Exploited Vulnerabilities catalog and notes known ransomware campaign use, which makes prompt vendor-guided remediation the top defensive action.

Recommended defensive actions

  • Apply updates per vendor instructions.
  • Inventory all Citrix ADC, Gateway, and SD-WAN WANOP appliances and confirm their patch status.
  • Validate that no affected appliance remains on an unremediated build.
  • Track remediation using vendor-supported management records and change-control evidence.

Evidence notes

This debrief is based only on the supplied CISA KEV record and official links. The KEV entry identifies the vulnerability as a Citrix ADC, Gateway, and SD-WAN WANOP Appliance code execution issue, marks it as known exploited, and records known ransomware campaign use. The KEV required action is to apply updates per vendor instructions. The supplied CVE and KEV timeline fields are dated 2021-11-03 and are used here as record timing context only.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-19781 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-19781

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-19781 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-19781

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.