CVE-2019-19781: Citrix ADC/Gateway path traversal leading to unauthenticated code execution
The short version: Citrix Application Delivery Controller (ADC) and Gateway have a path-traversal flaw (CVE-2019-19781) that lets an unauthenticated attacker escape into restricted directories and, in practice, execute code on the appliance. It scores a 9.8, it's in CISA's KEV catalog, and it became a favored initial-access route — including for ransomware crews. If you run an affected build, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.99th percentile (2026-07-16) |
| In CISA KEV? | Yes — remediation was due 2022-05-03 |
| Known exploited? | Yes — mass exploitation, including ransomware operators |
| Vulnerability type | CWE-22 path traversal → unauthorized access to restricted paths → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Citrix ADC & Gateway (and SD-WAN WANOP): 10.5, 11.1, 12.0, 12.1, and 13.0 |
| Fixed in | The refresh builds Citrix published for each supported line — see CTX267027 |
What you need to know
CVE-2019-19781 is a directory traversal. A crafted request walks outside the intended web root into restricted parts of the appliance's filesystem. Combined with how the device handles certain scripts, that traversal is enough for an unauthenticated attacker to place and run their own code — turning "read a path you shouldn't" into full control of the box.
That's why the practical impact runs to code execution even though the root cause is "just" a traversal:
- It's an access appliance. ADC and Gateway front applications and terminate remote-access sessions; control of one reaches well beyond a single host.
- It's pre-authentication and internet-facing. These interfaces are meant to be reachable, so there's no credential barrier and no chain required.
- It was exploited at scale. After disclosure it saw broad, automated exploitation and web-shell deployment, and it remained a reliable ransomware entry point long after fixes shipped.
How serious we see it
High — and the 9.8 is not an overstatement.
Unauthenticated, network-reachable code execution on a perimeter access device, confirmed exploited in the wild, is exactly the profile that belongs at the top of the queue. The bounded, reassuring part: it affects specific ADC/Gateway lines, the fixes have long been available, and exposure is quick to determine. The catch is the usual one for a mass-exploited flaw — a device left unpatched during the exploitation window may already carry a web shell, so patched and clean are separate questions.
Recommendations
Straight from Citrix's guidance (CTX267027) and CISA:
- Patch now. Upgrade to the fixed refresh build for your line (10.5 / 11.1 / 12.0 / 12.1 / 13.0), per CTX267027.
- If you can't patch immediately, apply Citrix's documented mitigation — then still schedule the upgrade.
- Hunt for prior compromise. Look for web shells and anomalous files under the traversal-reachable paths, and review appliance and authentication logs.
- If you find indicators, respond fully. Rebuild the appliance and rotate credentials, secrets, and certificates it held — this bug was routinely step one of an intrusion.
- Confirm your exposure first. Verify whether you run an affected ADC/Gateway build reachable from the internet at all.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing Citrix ADC/Gateway interfaces, fingerprints the build, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV.
That outside-in, continuous view is the whole point: when an access-appliance flaw is this heavily exploited, the exposed device is already mapped, so you can go straight to patch-and-verify rather than starting from an inventory.