VulnerabilityAnalyzed

CVE-2022-27518

Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

KEVCRITICAL 9.8EPSS 6.88%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 January 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Unauthenticated remote arbitrary code execution

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 6.88% probability · 94th percentile
CISA KEV: Listed 13 December 2022 · due 3 January 2023
Weakness: CWE-664
Affected: citrix/application delivery controller firmware · citrix/gateway firmware
Source: secure@citrix.com

CISA notes

Apply updates per vendor instructions. https://www.citrix.com/blogs/2022/12/13/critical-security-update-now-available-for-citrix-adc-citrix-gateway/; https://nvd.nist.gov/vuln/detail/CVE-2022-27518

References

https://support.citrix.com/article/CTX474995Vendor Advisory
https://support.citrix.com/article/CTX474995Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27518US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.