CVE-2021-22927: Citrix Application Delivery Controller Firmware

High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

Affected products

• Citrix Application Delivery Controller Firmware: from 11.1, before 11.1-65.22 (fixed in 11.1-65.22); from 12.1, before 12.1-62.27 (fixed in 12.1-62.27); from 13.0, before 13.0-82.45 (fixed in 13.0-82.45); from 12.1, before 12.1-55.238 (fixed in 12.1-55.238)
• Citrix Gateway: from 12.1, before 12.1-62.27 (fixed in 12.1-62.27); from 13.0, before 13.0-82.45 (fixed in 13.0-82.45)
• Citrix NetScaler Gateway: from 11.1, before 11.1-65.22 (fixed in 11.1-65.22)

Published 2021-08-05. Last modified 2026-06-17.