---
id: "CVE-2022-27518"
kind: "vulnerability"
aliases: ["CVE-2022-27518"]
title: "Unauthenticated remote arbitrary code execution"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Citrix Application Delivery Controller (ADC) and Gateway", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "citrix application delivery controller firmware", "fixed": ["12.1-55.291"], "affected": ">= 12.1, < 12.1-55.291", "ecosystem": "vendor"}, {"name": "citrix application delivery controller firmware", "fixed": ["12.1-65.25"], "affected": ">= 12.1, < 12.1-65.25", "ecosystem": "vendor"}, {"name": "citrix application delivery controller firmware", "fixed": ["13.0-58.32"], "affected": ">= 13.0, < 13.0-58.32", "ecosystem": "vendor"}, {"name": "citrix gateway firmware", "fixed": ["12.1-65.25"], "affected": ">= 12.1, < 12.1-65.25", "ecosystem": "vendor"}, {"name": "citrix gateway firmware", "fixed": ["13.0-58.32"], "affected": ">= 13.0, < 13.0-58.32", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adc", "citrix", "exploited", "gateway", "infrastructure", "netscaler", "saml"]
not_affected_if: ["no-saml-sp-or-idp-config"]
published_at: "2022-12-13T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27518", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27518", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Unauthenticated remote arbitrary code execution

Citrix ADC and Gateway appliances configured with SAML SP or IdP have an authentication bypass flaw. An unauthenticated attacker can run code as administrator on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Citrix Application Delivery Controller (ADC) and Gateway affected ? fixed ?
- vendor:citrix application delivery controller firmware affected >= 12.1, < 12.1-55.291 fixed 12.1-55.291
- vendor:citrix application delivery controller firmware affected >= 12.1, < 12.1-65.25 fixed 12.1-65.25
- vendor:citrix application delivery controller firmware affected >= 13.0, < 13.0-58.32 fixed 13.0-58.32
- vendor:citrix gateway firmware affected >= 12.1, < 12.1-65.25 fixed 12.1-65.25
- vendor:citrix gateway firmware affected >= 13.0, < 13.0-58.32 fixed 13.0-58.32

## How to check

Check whether the appliance is configured as a SAML SP or IdP (unknown which setting or file the sources name).

## Fix

Apply the Citrix update for CVE-2022-27518 per vendor instructions (specific fixed versions unknown from sources).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27518
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-27518

## From the sources

Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_