What’s Vulnerable › Vulnerabilities

CVE-2022-26355: Citrix Federated Authentication Service (FAS)

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-09 · updated 2026-06-17
• Weakness: CWE-668

Description

Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration.

Affected products

• Citrix Federated Authentication Service (FAS): from 7.17 through 10.6
• Citrix Federated Authentication Service (FAS): through 10.6; from 7.17

References

• https://support.citrix.com/article/CTX341587
• https://support.citrix.com/article/CTX341587

Get alerted when CVE-2022-26355 or the next vulnerability affects your stack