What’s Vulnerable › Vulnerabilities

CVE-2022-27518: Unauthenticated remote arbitrary code execution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-12-13
• EPSS: 6.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-13 · updated 2026-06-17
• Weakness: CWE-664

Description

Unauthenticated remote arbitrary code execution

Affected products

• Citrix Application Delivery Controller Firmware: from 12.1 before 12.1-65.25; from 13.0 before 13.0-58.32 — fixed in 12.1-65.25, 13.0-58.32
• Citrix Application Delivery Controller Firmware Fips: from 12.1 before 12.1-55.291 — fixed in 12.1-55.291
• Citrix Application Delivery Controller Firmware Ndcpp: from 12.1 before 12.1-55.291 — fixed in 12.1-55.291
• Citrix Gateway Firmware: from 12.1 before 12.1-65.25; from 13.0 before 13.0-58.32 — fixed in 12.1-65.25, 13.0-58.32
• Citrix Gateway, Citrix ADC: 12.1, 13.0, 12.1 FIPs, NDcPP

How to fix

Upgrade to a fixed version: Citrix Application Delivery Controller Firmware 12.1-65.25, 13.0-58.32; Citrix Application Delivery Controller Firmware Fips 12.1-55.291; Citrix Application Delivery Controller Firmware Ndcpp 12.1-55.291; Citrix Gateway Firmware 12.1-65.25, 13.0-58.32. Check the vendor advisory for mitigations.

References

• https://support.citrix.com/article/CTX474995
• https://support.citrix.com/article/CTX474995
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27518

Get alerted when CVE-2022-27518 or the next vulnerability affects your stack