CVE-2022-27518: Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-12-13. EPSS: 6.7% chance of exploitation in the next 30 days.

Unauthenticated remote arbitrary code execution

Affected products

• Citrix Application Delivery Controller Firmware: from 12.1, before 12.1-55.291 (fixed in 12.1-55.291); from 12.1, before 12.1-65.25 (fixed in 12.1-65.25); from 13.0, before 13.0-58.32 (fixed in 13.0-58.32)
• Citrix Gateway Firmware: from 12.1, before 12.1-65.25 (fixed in 12.1-65.25); from 13.0, before 13.0-58.32 (fixed in 13.0-58.32)

Published 2022-12-13. Last modified 2026-06-17.