CVE-2019-12989

CRITICAL KEV NUCLEI

Citrix SD-WAN 10.2.0-10.2.2 and NetScaler SD-WAN 10.0.0-10.0.7 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-12989 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 25, 2022. EIP tracks 1 public exploit. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates an authentication bypass (CVE-2019-12989) via SQL injection to write a token file, followed by command injection (CVE-2019-12991) to spawn a reverse shell on Citrix SD-WAN appliances. It requires a Netcat listener for shell reception.

Description

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

Exploits (1)

exploitdb WORKING POC
pythonwebappscgi
https://www.exploit-db.com/exploits/47112

This exploit demonstrates an authentication bypass (CVE-2019-12989) via SQL injection to write a token file, followed by command injection (CVE-2019-12991) to spawn a reverse shell on Citrix SD-WAN appliances. It requires a Netcat listener for shell reception.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Citrix SD-WAN Appliance 10.2.2
No auth needed
Prerequisites: Network access to the target · Netcat listener setup
devstral-2 · analyzed Feb 19, 2026 Full analysis →

Nuclei Templates (1)

Citrix SD-WAN and NetScaler SD-WAN - SQL Injection
CRITICALby ritikchaddha
FOFA: (title="citrix sd-wan") && icon_hash="177980953"

References (5)

Core 5
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.tenable.com/security/research/tra-2019-32
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/109133
Vendor Advisory x_refsource_misc
https://support.citrix.com/article/CTX251987

Scores

CVSS v3 9.8
EPSS 0.9435
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2022-03-25
VulnCheck KEV 2020-12-01
InTheWild.io 2019-12-13
ENISA EUVD EUVD-2019-4564
CWE
CWE-89
Status published
Products (2)
citrix/netscaler_sd-wan 10.0.0 - 10.0.8
citrix/sd-wan 10.2.0 - 10.2.3
Published Jul 16, 2019
KEV Added Mar 25, 2022
Tracked Since Feb 18, 2026