CVE-2022-27518: Citrix ADC and Gateway unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction, listed in CISA KEV as exploited, on edge devices that provide direct access to internal networks.

What it is

CVE-2022-27518 is an unauthenticated remote arbitrary code execution flaw in Citrix Application Delivery Controller (ADC) and Gateway firmware. The CVSS vector shows network reachability with no privileges or user interaction, so any exposed appliance is directly at risk. It matters because these devices sit at the network edge and a compromise gives an attacker a foothold on critical infrastructure.

Impact

An attacker can execute arbitrary code on the appliance without authenticating, gaining full control of the device. From there they can read or modify traffic, credentials and configurations, and pivot into the internal network.

Attack surface

Reached over the network via the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. Any internet- or network-exposed ADC or Gateway management or traffic interface is a potential entry point.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2022-12-13 with a remediation due date of 2023-01-03, indicating exploitation in the wild. EPSS gives a 30-day probability of 0.06875 (93.7th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Citrix updates referenced in vendor advisory CTX474995 immediately; this is the required action per CISA KEV.
• If patching cannot be done at once, remove or restrict network access to ADC and Gateway interfaces from untrusted networks.
• Place appliances behind filtering that only permits known management and service traffic, and disable unnecessary exposed services.
• After patching, rotate credentials and certificates that were present on or passed through the appliance, and review configurations for unauthorized changes.
• Monitor vendor and CISA guidance for any updated fixed versions or interim mitigations.

Detection

• Review ADC and Gateway logs for unexpected process execution, shell activity or configuration changes around the time of suspected access.
• Hunt for anomalous outbound connections from the appliance to unfamiliar hosts, which can indicate post-exploitation command and control.
• Check for unauthorized local accounts, modified authentication policies or new certificates on the appliance.
• Correlate network monitoring for exploit attempts against ADC and Gateway endpoints with subsequent suspicious device behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.