CVE-2022-27518: Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

Q: How do I fix CVE-2022-27518?

application delivery controller firmware: upgrade to 12.1-55.291, 12.1-65.25, 13.0-58.32; gateway firmware: upgrade to 12.1-65.25, 13.0-58.32. Exact commands for each OS are on this page.

Q: Is CVE-2022-27518 being exploited?

Yes. CVE-2022-27518 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2022-27518 affect?

CVE-2022-27518 affects application delivery controller firmware, gateway firmware. Severity is critical (CVSS 9.8). Unauthenticated remote arbitrary code execution

Q: How urgent is CVE-2022-27518?

Priority 91/100. Critical severity; EPSS top 6%: very likely to be exploited; Exploited in the wild (CISA KEV); CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Patch now

CRITICAL 9.8EXPLOITEDREMOTEUPGRADEUPGRADE

CVE-2022-27518 is a critical-severity flaw (CVSS 9.8) affecting application delivery controller firmware, gateway firmware, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Unauthenticated remote arbitrary code execution

Why this priority

Critical severity
EPSS top 6%: very likely to be exploited
Exploited in the wild (CISA KEV)
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	6.9% (top 6%)
CISA exploited list	Yes, fix due 2023-01-03
Weakness	CWE-664
Published	2022-12-13
Last modified	2026-06-17

Publisher (CNA): Citrix Systems, Inc. · Vendor: citrix

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-12-13Exploited Added to the CISA Known Exploited Vulnerabilities list
2022-12-13 17:15 UTCPublished CVE record published
2023-01-03Deadline CISA due date for US federal agencies to patch
2026-06-17 04:37 UTCUpdated Record last modified

citrix application delivery controller firmware UPGRADE

Affected: >= 12.1 and < 12.1-55.291 · >= 12.1 and < 12.1-65.25 · >= 13.0 and < 13.0-58.32

Fixed in: 12.1-55.291, 12.1-65.25, 13.0-58.32

Safe to downgrade to: a release before 12.1

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

citrix gateway firmware UPGRADE

Affected: >= 12.1 and < 12.1-65.25 · >= 13.0 and < 13.0-58.32

Fixed in: 12.1-65.25, 13.0-58.32

Safe to downgrade to: a release before 12.1

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Exact fixes by distribution

Fedora ELN · libslirp · FIXED · 4.9.7-1.eln159 · FEDORA-2026-209cb94e13 · source

sudo dnf upgrade --advisory=FEDORA-2026-209cb94e13

Fedora 46 · modpoll · FIXED · 1.6.1-1.fc46 · FEDORA-2026-60d403ff15 · source

sudo dnf upgrade --advisory=FEDORA-2026-60d403ff15

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: dolby360/CVE-2022-27518_POC (2 stars)

Advisories and coverage

Official advisories

IPA Japan Security Alerts: Citrix ADC および Citrix Gateway の脆弱性について（CVE-2022-27518） 2022-12-13

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-27518?

application delivery controller firmware: upgrade to 12.1-55.291, 12.1-65.25, 13.0-58.32; gateway firmware: upgrade to 12.1-65.25, 13.0-58.32. Exact commands for each OS are on this page.

Is CVE-2022-27518 being exploited?

Yes. CVE-2022-27518 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2022-27518 affect?

CVE-2022-27518 affects application delivery controller firmware, gateway firmware. Severity is critical (CVSS 9.8). Unauthenticated remote arbitrary code execution

How urgent is CVE-2022-27518?

Priority 91/100. Critical severity; EPSS top 6%: very likely to be exploited; Exploited in the wild (CISA KEV); CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Citrix vulnerabilities

Related CVEs

CVE-2019-19781 CRITICAL 9.8 EXPLOITED MITIGATE MITIGATE Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
CVE-2022-27516 MEDIUM 5.3 UPGRADE UPGRADE User login brute force protection functionality bypass
CVE-2022-27513 HIGH 8.3 UPGRADE UPGRADE Remote desktop takeover via phishing
CVE-2022-27510 CRITICAL 9.8 UPGRADE UPGRADE Unauthorized access to Gateway user capabilities
CVE-2022-27509 MEDIUM 6.1 UPGRADE UPGRADE Unauthenticated redirection to a malicious website

References

← Back to latest CVEs