CVE-2022-27518

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 6.9%; technical severity is CVSS 9.8.

Unauthenticated remote arbitrary code execution

Who should care

• Teams operating Application Delivery Controller (ADC) and Gateway, Application Delivery Controller Firmware, Gateway Firmware
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Application Delivery Controller (ADC) and Gateway, Application Delivery Controller Firmware, Gateway Firmware is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Citrix Security advisory CTX474995
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-664

Affected versions

Citrix Application Delivery Controller (ADC) and Gateway; Citrix Application Delivery Controller Firmware (Start Including 12.1, End Excluding 12.1-55.291 | Start Including 12.1, End Excluding 12.1-55.291 | Start Including 12.1, End Excluding 12.1-65.25 | Start Including 13.0, End Excluding 13.0-58.32); Citrix Gateway Firmware (Start Including 12.1, End Excluding 12.1-65.25 | Start Including 13.0, End Excluding 13.0-58.32)

Fixed versions

Citrix Application Delivery Controller Firmware (Fixed from 12.1-55.291, 12.1-65.25, 13.0-58.32); Citrix Gateway Firmware (Fixed from 12.1-65.25, 13.0-58.32)

Published

13 December 2022

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 13 Dec 2022CVE published
2. 12 Dec 2022Added to CISA KEV
3. 20 Aug 2026Latest EPSS score: 6.9%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 70

External references

• CISA Government advisory CVE-2022-27518 ↗