CVE-2021-22955: Citrix Application Delivery Controller Firmware

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow an attacker to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication.

Affected products

• Citrix Application Delivery Controller Firmware: up to and including 11.1-65.23; from 12.1, before 12.1-63.22 (fixed in 12.1-63.22); from 13.0, before 13.0-83.27 (fixed in 13.0-83.27)
• Citrix Gateway: before 11.1-65.23 (fixed in 11.1-65.23); from 12.1, before 12.1-63.22 (fixed in 12.1-63.22); from 13.0, before 13.0-83.27 (fixed in 13.0-83.27)

Published 2021-12-07. Last modified 2026-06-17.