CVE-2022-27516: Citrix Application Delivery Controller Firmware

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

User login brute force protection functionality bypass

Affected products

• Citrix Application Delivery Controller Firmware: from 12.1, before 12.1-65.21 (fixed in 12.1-65.21); from 13.0, before 13.0-88.12 (fixed in 13.0-88.12); from 13.1, before 13.1-33.47 (fixed in 13.1-33.47); from 12.1, before 12.1-55.289 (fixed in 12.1-55.289)
• Citrix Gateway: from 12.1, before 12.1-65.21 (fixed in 12.1-65.21); from 13.0, before 13.0-88.12 (fixed in 13.0-88.12); from 13.1, before 13.1-33.47 (fixed in 13.1-33.47)

Published 2022-11-08. Last modified 2026-06-17.