{"id":"CVE-2022-27518","kind":"vulnerability","aliases":["CVE-2022-27518"],"related":[],"title":"Unauthenticated remote arbitrary code execution","description":"Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Citrix ADC and Gateway appliances configured with SAML SP or IdP have an authentication bypass flaw. An unauthenticated attacker can run code as administrator on the appliance.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2022-12-13T00:00:00+00:00","products":[{"name":"Citrix Application Delivery Controller (ADC) and Gateway","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"citrix application delivery controller firmware","fixed":["12.1-55.291"],"affected":">= 12.1, < 12.1-55.291","ecosystem":"vendor"},{"name":"citrix application delivery controller firmware","fixed":["12.1-65.25"],"affected":">= 12.1, < 12.1-65.25","ecosystem":"vendor"},{"name":"citrix application delivery controller firmware","fixed":["13.0-58.32"],"affected":">= 13.0, < 13.0-58.32","ecosystem":"vendor"},{"name":"citrix gateway firmware","fixed":["12.1-65.25"],"affected":">= 12.1, < 12.1-65.25","ecosystem":"vendor"},{"name":"citrix gateway firmware","fixed":["13.0-58.32"],"affected":">= 13.0, < 13.0-58.32","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adc","citrix","exploited","gateway","infrastructure","netscaler","saml"],"not_affected_if":["no-saml-sp-or-idp-config"],"how_to_check":"Check whether the appliance is configured as a SAML SP or IdP (unknown which setting or file the sources name).","fix":"Apply the Citrix update for CVE-2022-27518 per vendor instructions (specific fixed versions unknown from sources).","status":"open","published_at":"2022-12-13T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:52+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:08:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Citrix update for CVE-2022-27518 per vendor instructions (specific fixed versions unknown from sources).\nunknown","reach":"internet","impact":"high","summary":"Citrix ADC and Gateway appliances configured with SAML SP or IdP have an authentication bypass flaw. An unauthenticated attacker can run code as administrator on the appliance.","category":"infrastructure","who_cares":["citrix","netscaler","adc","gateway","saml"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code as administrator on the appliance","analyst_note":"Find the affected and fixed Citrix ADC/Gateway versions and the exact SAML configuration trigger from Citrix advisory CTX474995 or the CISA KEV entry.","how_to_check":"Check whether the appliance is configured as a SAML SP or IdP (unknown which setting or file the sources name).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-saml-sp-or-idp-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000491,"input_tokens":2854,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':7A,10A '-27518':8A,11A 'action':105C 'adc':16A,40B,48B,78C 'administr':70B,102C 'allow':95C 'and':17A 'appli':106C 'applianc':51B,73B 'applic':75C 'application':13A,20A,25A,30A 'arbitrari':3A 'attack':65B,97C 'authent':60B,91C 'bypass':61B,92C 'cisa':103C 'citrix':12A,19A,24A,29A,34A,37A,41B,47B,74C 'code':4A,68B,100C 'configur':52B,82C,88C 'contain':89C 'control':77C 'controller':15A,22A,27A,32A 'cve':6A,9A 'deliveri':76C 'delivery':14A,21A,26A,31A 'execut':5A,99C 'exploit':42B 'firmware':23A,28A,33A,36A,39A 'flaw':62B 'gateway':18A,35A,38A,43B,50B,80C 'idp':57B,87C 'infrastructur':44B 'instruct':110C 'netscal':45B 'per':108C 'remot':2A 'requir':104C 'run':67B 'saml':46B,54B,84C 'sp':55B,85C 'unauthent':1A,64B 'updat':107C 'vendor':109C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-12-13T00:00:00+00:00","kev":{"dateAdded":"2022-12-13","dueDate":"2023-01-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@citrix.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-27518","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27518","severity":null,"published_at":"2022-12-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-27518","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27518","severity":null,"published_at":"2022-12-13T17:15:14+00:00","modified_at":"2026-06-17T04:37:09+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}