# CVE-2019-12986: Citrix SD-WAN - RCE

> Live exploitation tracking for CVE-2019-12986 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2019-12986

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Citrix SD-WAN
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** enterprise_software

## Description

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6).

## CrowdSec analysis

[CVE-2019-12986](https://euvd.enisa.europa.eu/vulnerability/CVE-2019-12986) is a critical vulnerability in Citrix SD-WAN and NetScaler SD-WAN products due to improper input validation, allowing remote attackers to potentially execute arbitrary code without authentication. This flaw could be exploited to fully compromise affected systems, leading to unauthorized access, data theft, or service disruption.

CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2019-12986 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
In addition, according to the CrowdSec network, attack volume against CVE-2019-12986 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending crafted POST requests to the `/Collector/diagnostics/trace_route` endpoint, injecting malicious commands via the `ipAddress` parameter to achieve remote code execution.

## Timeline

- 2019-07-16: CVE Published. CVE-2019-12986 is published to NVD.
- 2026-02-11: Rule Released. CrowdSec releases a rule to detect CVE-2019-12986 exploitation attempts against the CrowdSec Network.
- 2026-02-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2019-12986 for the first time.

## References

- https://www.tenable.com/security/research/tra-2019-31
- http://www.securityfocus.com/bid/109133
- https://support.citrix.com/article/CTX251987
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12986.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2019-12986) follows observed exploitation activity for CVE-2019-12986. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.