CVE-2021-22927

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-05 · updated 2026-06-17
Weakness: CWE-384

Description

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

Affected products

Citrix Application Delivery Controller Firmware: from 11.1 before 11.1-65.22; from 12.1 before 12.1-62.27; from 13.0 before 13.0-82.45; from 12.1 before 12.1-55.238 — fixed in 11.1-65.22, 12.1-62.27, 13.0-82.45, 12.1-55.238
NetScaler Gateway: from 12.1 before 12.1-62.27; from 13.0 before 13.0-82.45 — fixed in 12.1-62.27, 13.0-82.45
Citrix NetScaler Gateway: from 11.1 before 11.1-65.22 — fixed in 11.1-65.22
Citrix ADC, Citrix Gateway: Citrix ADC and Citrix Gateway 13.0-82.45 and later releases of 13.0, Citrix ADC and Citrix Gateway 12.1-62.27 and later releases of 12.1, Citrix ADC and NetScaler Gateway 11.1-65.22 and later releases of 11.1, Citrix ADC 12.1-FIPS 12.1-55.247 and later releases of 12.1-FIPS

How to fix

Upgrade to a fixed version: Citrix Application Delivery Controller Firmware 11.1-65.22, 12.1-62.27, 13.0-82.45, 12.1-55.238; NetScaler Gateway 12.1-62.27, 13.0-82.45; Citrix NetScaler Gateway 11.1-65.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22927 or the next vulnerability affects your stack