{"id":"CVE-2019-19781","published":"2019-12-27T14:15:12Z","modified":"2026-08-12T05:17:21Z","title":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","tier":"core","eol":null,"description":{"text":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.","provenance":"source","from":"NVD"},"summary":{"text":"A directory traversal flaw, classified as improper limitation of a pathname to a restricted directory, exists in Citrix Application Delivery Controller (ADC) and Gateway appliances, and the advisory's title also covers the SD-WAN WANOP Appliance. An attacker can exploit it over the network without authentication or user interaction, with low complexity, to reach files outside the intended restricted directory.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:08Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99998,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-19781","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-01-16","exploitedFirstSeen":"2020-01-16","ransomware":true,"evidence":[{"url":"https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html","date":"2020-01-16"},{"url":"https://cisa.gov/news-events/alerts/2020/01/23/citrix-releases-security-updates-sd-wan-wanop","date":"2020-01-23"},{"url":"https://diriga.com/2020/02/26/bretagne-telecom-fell-victim-of-doppelpaymer-ransomware-attack/","date":"2020-02-26"},{"url":"https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign-using-multiple-exploits","date":"2020-03-25"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-099a","date":"2020-04-08"},{"url":"https://blog.talosintelligence.com/2020/04/IR-quarterly-threat-report-spring-2020.html","date":"2020-04-13"},{"url":"https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/","date":"2020-04-13"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-133a","date":"2020-05-12"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-031a","date":"2020-05-21"},{"url":"https://media.defense.gov/2020/Jul/16/2002457639/-1/-1/0/NCSC_APT29_ADVISORY-QUAD-OFFICIAL-20200709-1810.PDF","date":"2020-07-16"}],"evidenceTotal":933,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://forms.gle/eDf3DXZAv96oosfj6","tags":["Third Party Advisory"]},{"url":"https://support.citrix.com/article/CTX267027","tags":["Vendor Advisory"]},{"url":"https://twitter.com/bad_packets/status/1215431625766424576","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/619785","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://forms.gle/eDf3DXZAv96oosfj6","tags":["Third Party Advisory"]},{"url":"https://support.citrix.com/article/CTX267027","tags":["Vendor Advisory"]},{"url":"https://twitter.com/bad_packets/status/1215431625766424576","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/619785","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19781","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC). ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC). ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1083","name":"File and Directory Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","dataset-annotation"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution; TRAM2 annotated sentence label","mappingType":"secondary_impact","evidence":[{"reportId":"SRC-a69a17064744ac89d968","quote":"CVE-2019-19781 enabled the actors to execute directory traversal attacks.[8]","start":9066,"end":9142}],"comment":"CVE-2019-19781 is exploited through directory traversal, allowing an unauthenticated attacker to execute arbitrary code on affected Citrix Netscaler Application Delivery Control (ADC). ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"machine","basis":"dataset-annotation","bases":["dataset-annotation"],"basisDetail":"AnnoCTR expert entity-linking label (train split); TRAM2 annotated sentence label","mappingType":null,"evidence":[{"reportId":"SRC-9411ade85d96fe0246ff","quote":"In December 2019, we began to see less sophisticated threat actors share information from open source reports about CVE-2019-19781 and new forum threads started where actors sought to buy an exploit for the vulnerability.","start":7328,"end":7549},{"reportId":"SRC-9411ade85d96fe0246ff","quote":"* An actor shared several code variants for CVE-2019-19781.","start":9103,"end":9162},{"reportId":"SRC-a69a17064744ac89d968","quote":"CISA has observed the actors leveraging CVE-2019-19781 to compromise Citrix Application Delivery Controllers.","start":15032,"end":15141}],"confidence":"low","confidenceNote":"machine-matched from report text"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"machine","basis":"report-passage","bases":["report-passage"],"basisDetail":"keyword query KW:T1505.003:1","mappingType":null,"evidence":[{"reportId":"SRC-cc205ca91d4f5c5b85cc","quote":"The following file paths can be used to detect Tiny web shell, ChunkyTuna web shell, or Chisel if a network has been compromised by this attacker exploiting CVE-2019-19781.","start":3768,"end":3940}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-f144807c3c05fbc98a1a","title":"Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","date":"2022-05-09","mentions":[{"quote":"Citrix ADC systems affected by CVE-2019-19781","start":62193,"end":62238}]},{"id":"SRC-9411ade85d96fe0246ff","title":"Prioritizing “critical” vulnerabilities: A threat intelligence perspective","publisher":"Intel 471","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/intel471_2020-08-12_prioritizing-critical-vulnerabilities-a-threat.txt","date":"2020-08-12","mentions":[{"quote":"### CVE-2019-19781","start":7066,"end":7084},{"quote":"This Citrix Application Delivery Controller, Citrix Gateway and Citrix SD-WAN WANOP appliance vulnerability, CVE-2019-19781, was disclosed in December 2019 and last updated in the U.S.","start":7086,"end":7270},{"quote":"In December 2019, we began to see less sophisticated threat actors share information from open source reports about CVE-2019-19781 and new forum threads started where actors sought to buy an exploit for the vulnerability.","start":7328,"end":7549},{"quote":"* Several actors across multiple popular cybercrime forums posted information from open source reporting about the disclosure of CVE-2019-19781.","start":8203,"end":8347},{"quote":"Several actors replied expressing a similar interest or discussing exploitability of CVE-2019-19781.","start":8539,"end":8639}]},{"id":"SRC-cc205ca91d4f5c5b85cc","title":"Iran-Based Threat Actor Exploits VPN Vulnerabilities","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-259a","date":null,"mentions":[{"quote":"CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.","start":1953,"end":2103},{"quote":"The following file paths can be used to detect Tiny web shell, ChunkyTuna web shell, or Chisel if a network has been compromised by this attacker exploiting CVE-2019-19781.","start":3768,"end":3940},{"quote":"As indicated in table 2, the threat actor primarily gained initial access by using the publicly available exploit for CVE-2019-19781.","start":4296,"end":4429},{"quote":"If your organization has not patched for the Citrix CVE-2019-19781 vulnerability, and a compromise is suspected, follow the recommendations in CISA Alert AA20-031A.","start":6353,"end":6517},{"quote":"CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781CISA Alert AA20-073A: Enterprise VPN SecurityCISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN PatchingCISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902CISA Security Tip: Securing Network Infrastructure Devices","start":8312,"end":8630}]},{"id":"SRC-a69a17064744ac89d968","title":"AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity","publisher":"us-cert.cisa.gov","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-258a","date":null,"mentions":[{"quote":"CVE-2019-19781: Citrix Virtual Private Network (VPN) Appliances","start":8907,"end":8970},{"quote":"CVE-2019-19781 enabled the actors to execute directory traversal attacks.[8]","start":9066,"end":9142},{"quote":"CISA has observed the actors leveraging CVE-2019-19781 to compromise Citrix Application Delivery Controllers.","start":15032,"end":15141},{"quote":"CVE-2019-19781","start":21380,"end":21394},{"quote":"Exploited Vulnerabilities [7] CISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902 [8] CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781 [9] CISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching [10] GitHub [11] Exploit-DB [12] What is Mimikatz: The","start":23719,"end":24029}]},{"id":"SRC-8b6e5f3c2592261e3f88","title":"Advisory further TTPs associated with SVR cyber actors","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf","date":null,"mentions":[{"quote":"• CVE-2019-19781 Citrix","start":2746,"end":2769}]},{"id":"SRC-8523fa0711da20753fbc","title":"Nefilim Ransomware","publisher":"blog.qualys.com","url":"https://blog.qualys.com/vulnerabilities-threat-research/2021/05/12/nefilim-ransomware","date":null,"mentions":[{"quote":"Nefilim targets vulnerabilities such as CVE-2019-11634 and CVE-2019-19781 in Citrix gateway devices, identified in December 2019 and patched in January 2020.","start":1121,"end":1278}]},{"id":"SRC-6a1b1e8f3a7b99e55bf0","title":"Advisory: APT29 targets","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf","date":null,"mentions":[{"quote":"• CVE-2019-19781 Citrix [1]","start":3120,"end":3147}]},{"id":"SRC-32e6cf5c407f3cfe12fc","title":"AA21-200B: Chinese State-Sponsored Cyber Operations: Observed TTPs","publisher":"us-cert.cisa.gov","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200b","date":null,"mentions":[{"quote":"Many exploits can be mitigated by applying available patches for vulnerabilities (such as CVE-2019-11510, CVE-2019-19781, and CVE-2020-5902) affecting external remote services.","start":20743,"end":20919}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-9380","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9380","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":47901,"url":"https://www.exploit-db.com/exploits/47901","title":"Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution (PoC)","type":"webapps","platform":"multiple","date":"2020-01-11","verified":false,"provenance":"source"},{"id":47913,"url":"https://www.exploit-db.com/exploits/47913","title":"Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit)","type":"webapps","platform":"multiple","date":"2020-01-13","verified":false,"provenance":"source"},{"id":47930,"url":"https://www.exploit-db.com/exploits/47930","title":"Citrix Application Delivery Controller (ADC) and Gateway 13.0 - Path Traversal","type":"webapps","platform":"multiple","date":"2020-01-16","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2020-01-11"},"pocGithub":{"count":38,"skipped":6,"earliest":"2020-01-10","earliestUrl":"https://github.com/projectzeroindia/CVE-2019-19781","repos":[{"name":"trustedsec/cve-2019-19781","url":"https://github.com/trustedsec/cve-2019-19781","stars":573,"created":"2020-01-11"},{"name":"projectzeroindia/CVE-2019-19781","url":"https://github.com/projectzeroindia/CVE-2019-19781","stars":369,"created":"2020-01-10"},{"name":"mpgn/CVE-2019-19781","url":"https://github.com/mpgn/CVE-2019-19781","stars":157,"created":"2020-01-11"},{"name":"MalwareTech/CitrixHoneypot","url":"https://github.com/MalwareTech/CitrixHoneypot","stars":120,"created":"2020-01-13"},{"name":"cisagov/check-cve-2019-19781","url":"https://github.com/cisagov/check-cve-2019-19781","stars":110,"created":"2020-01-11"}]},"metasploit":[{"name":"Citrix ADC (NetScaler) Directory Traversal Scanner","module":"auxiliary/scanner/http/citrix_dir_traversal","type":"auxiliary","disclosureDate":"2019-12-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/citrix_dir_traversal.rb"},{"name":"Citrix ADC (NetScaler) Directory Traversal RCE","module":"exploit/freebsd/http/citrix_dir_traversal_rce","type":"exploit","disclosureDate":"2019-12-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb"}],"nuclei":[{"id":"CVE-2019-19781","name":"Citrix ADC and Gateway - Directory Traversal","severity":"critical","path":"http/cves/2019/CVE-2019-19781.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-19781.yaml"}],"first":{"date":"2019-12-17","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/citrix_dir_traversal.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Citrix Netscaler Attack CVE-2019-19781","id":"ac5a6409-8c89-44c2-8d64-668c29a2d756","level":"critical","status":"test","path":"rules-emerging-threats/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html","http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html","http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html","http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html","http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1083"],"provenance":"source"},{"stage":"observed","techniques":["T1190","T1505.003"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2019-12-17","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-01-10, Exploit-DB 2020-01-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/citrix_dir_traversal.rb","provenance":"source"},{"date":"2019-12-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19781","provenance":"source"},{"date":"2020-01-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html","provenance":"source"},{"date":"2020-08-12","kind":"report","label":"Named in Intel 471: Prioritizing “critical” vulnerabilities: A threat intelligence perspective","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/intel471_2020-08-12_prioritizing-critical-vulnerabilities-a-threat.txt","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9380","provenance":"source"},{"date":"2022-05-09","kind":"report","label":"Named in microsoft.com: Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":677},"priority":{"score":89.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2479 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":10.0,"detail":"8 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 Exploit-DB entries; 5 NVD exploit links; 38 PoC-in-GitHub repos; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}