⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2022-27510 — Authentication Bypass Using an Alternate Path or Channel in Citrix Gateway

CWE-288 — Authentication Bypass Using an Alternate Path or ChannelCWE-345 — Insufficient Verification of Data AuthenticityCWE-693 — Protection Mechanism Failure4 documents4 sources
Severity
9.8CRITICALCNA
No vector
EPSS
1.6%
top 18.34%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
3
Citrix ADCCitrix GatewayCitrix Xenserver
Timeline
PublishedNov 8
Latest updateNov 10

Description

Unauthorized access to Gateway user capabilities Unauthorized access to Gateway user capabilities

Affected Packages3 packages

🔴Vulnerability Details

2
CVEList
Unauthorized access to Gateway user capabilities↗2022-11-08
▶
VulnCheck
Citrix ShareFile Authentication Bypass Using an Alternate Path or Channel↗2022
▶

📋Vendor Advisories

1
Citrix
Citrix Gateway and Citrix ADC Security Bulletin for CVE-2022-27510 CVE-2022-27513 and CVE-2022-27516↗2022-11-10
▶

🕵️Threat Intelligence

1
Tenable
CVE-2022-27510: Critical Citrix ADC and Gateway Authentication Bypass Vulnerability↗2022-11-09
▶