Citrix SD-WAN - RCE (CVE-2019-12987)

CVE-2019-12987 is a critical vulnerability in Citrix SD-WAN and NetScaler SD-WAN versions prior to 10.2.3 and 10.0.8, respectively, due to improper input validation. This flaw could allow remote attackers to execute arbitrary code without authentication, potentially leading to full system compromise and exposure of sensitive data.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2019-12987 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec network telemetry also shows that exploitation of CVE-2019-12987 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the /Collector/storagemgmt/apply endpoint by injecting OS commands into parameters such as data[0][host], often using backticks or other shell metacharacters to achieve remote command execution on Citrix SD-WAN Center systems.