CVE-2019-19781

First PoC 2020-01-11
1992 days →Metasploit 2025-06-25
479 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD: not stated by sourcesNo NVD record yet.
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

6 known · links only

Metasploit2

Citrix ADC (NetScaler) Directory Traversal RCE ↗
This module exploits a directory traversal in Citrix Application Delivery Controller (ADC), aka NetScaler, and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0, to execute an arbitrary command payload.
ruby · seen 2026-10-18
Citrix ADC (NetScaler) Directory Traversal Scanner ↗
This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC (NetScaler). It requests the smb.conf file located in the /vpns/cfg directory by issuing the request /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presence of a "[global]" directive in smb.conf, which this file should always contain.
ruby · seen 2026-10-18

Exploit-DB3

Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution (PoC) ↗
created 2020-01-11
Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit) ↗
created 2020-01-13
Citrix Application Delivery Controller (ADC) and Gateway 13.0 - Path Traversal ↗
created 2020-01-16

Nuclei1

Citrix ADC and Gateway - Directory Traversal ↗
Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 are susceptible to directory traversal vulnerabilities.
yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

Fox Kitten
1. “In the Fox Kitten report, we reported three main vulnerabilities the group used, and by February 2020, we observed an exploitation of CVE-2019-19781 as well.”
  cited as exploiting · source: clearskysec.com ↗ · 2026-10-17
2. “Citrix “ADC” servers and Citrix network gateways (CVE-2019-19781)”
  cited as exploiting · named nearby · source: zdnet.com ↗ · 2026-10-17
3. “The adversary is particularly interested in exploits related to VPNs and network appliances , including CVE-2019-11510, CVE-2019-19781, and most recently CVE-2020-5902; reliance on exploits such as these lends to an opportunistic operational model.”
  cited as exploiting · named nearby · source: crowdstrike.com ↗ · 2026-10-17
4. “Citrix “ADC” servers and Citrix network gateways (CVE-2019-19781)”
  cited as exploiting · named nearby · source: zdnet.com ↗ · 2026-10-17
APT41
1. “APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “The adversary began 2020 by conducting a wide-ranging campaign focused on exploiting multiple vulnerabilities (CVE-2019-19781 and CVE- 2020-10189)”
  cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17
APT29
1. “APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals