CVE-2019-12989

Citrix SD-WAN and NetScaler suffered a SQL injection vulnerability that was actively exploited in the wild.

Citrix SD-WAN and NetScaler products contained a SQL injection flaw (CVE-2019-12989) that was listed on CISA's KEV catalog, indicating active exploitation. DIB organizations must ensure these products are patched and monitored, as SQL injection can lead to data exfiltration and system compromise. The failure highlights the risk of relying on unpatched or vulnerable network infrastructure.

Shame score — A known SQL injection vulnerability in widely deployed Citrix products was actively exploited in the wild, demonstrating a failure to patch known CVEs and a lack of timely security updates.