CVEvulnerability

CVE-2022-27518

9.8 CRITICAL Known exploited Published 2022-12-13 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability — Citrix Application Delivery Controller (ADC) and Gateway

Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.

Added to KEV: 2022-12-13
Remediation due: 2023-01-03
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://www.citrix.com/blogs/2022/12/13/critical-security-update-now-available-for-citrix-adc-citrix-gateway/; https://nvd.nist.gov/vuln/detail/CVE-2022-27518

Status: Analyzed
Published: 2022-12-13
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-664

Description

Unauthenticated remote arbitrary code execution

Affected configurations

• citrix application delivery controller firmware (>= 12.1 < 12.1-55.291) • citrix application delivery controller firmware (>= 12.1 < 12.1-65.25) • citrix application delivery controller firmware (>= 13.0 < 13.0-58.32) • citrix gateway firmware (>= 12.1 < 12.1-65.25) • citrix gateway firmware (>= 13.0 < 13.0-58.32)

Weakness · CWE (1)

CWE-664 Improper Control of a Resource Through its Lifetime weakness

References