CVE-2022-27509: Unauthenticated redirection to a malicious website

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-28 · updated 2026-06-17
Weakness: CWE-601

Description

Unauthenticated redirection to a malicious website

Affected products

Citrix Application Delivery Controller Firmware: from 12.1 before 12.1-65.15; from 13.0 before 13.0-86.17; from 13.1 before 13.1-24.38 — fixed in 12.1-65.15, 13.0-86.17, 13.1-24.38
Citrix Application Delivery Controller Firmware Fips: from 12.1 before 12.1-55.282 — fixed in 12.1-55.282
Citrix Application Delivery Controller Firmware Ndcpp: from 12.1 before 12.1-55.282 — fixed in 12.1-55.282
NetScaler Gateway: from 12.1 before 12.1-65.15; from 13.0 before 13.0-86.17; from 13.1 before 13.1-24.38 — fixed in 12.1-65.15, 13.0-86.17, 13.1-24.38
Citirx Citrix Application Delivery Management (Citrix ADC) and Citrix Gateway: from 13.1 before 24.38; from 13.0 before 86.17; from 12.1 before 65.15 — fixed in 24.38, 86.17, 65.15

How to fix

Upgrade to a fixed version: Citrix Application Delivery Controller Firmware 12.1-65.15, 13.0-86.17, 13.1-24.38; Citrix Application Delivery Controller Firmware Fips 12.1-55.282; Citrix Application Delivery Controller Firmware Ndcpp 12.1-55.282; NetScaler Gateway 12.1-65.15, 13.0-86.17, 13.1-24.38; Citirx Citrix Application Delivery Management (Citrix ADC) and Citrix Gateway 24.38, 86.17, 65.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-27509 or the next vulnerability affects your stack