⚠ Actively exploited
Added to CISA KEV on 2022-12-13. Federal agencies required to patch by 2023-01-03. Required action: Apply updates per vendor instructions..

CVE-2022-27518 — Improper Control of a Resource Through its Lifetime in Citrix ADC

CWE-664 — Improper Control of a Resource Through its Lifetime17 documents9 sources
Severity
9.8CRITICALCNA
No vector
EPSS
27.7%
top 3.54%
CISA KEV
KEV
Added 2022-12-13
Due 2023-01-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
3
Citrix ADCCitrix GatewayCitrix Xenserver
Timeline
PublishedDec 13
KEV addedDec 13
KEV dueJan 3
Latest updateAug 26
CISA Required Action: Apply updates per vendor instructions.

Description

Unauthenticated remote arbitrary code execution Unauthenticated remote arbitrary code execution

Affected Packages3 packages

🔴Vulnerability Details

2
CVEList
Unauthenticated remote arbitrary code execution↗2022-12-13
▶
VulnCheck
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability↗2022
▶

📋Vendor Advisories

2
CISA
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability↗2022-12-13
▶
Citrix
Citrix ADC and Citrix Gateway Security Bulletin for CVE-2022-27518↗2022-12-13
▶

🕵️Threat Intelligence

13
Tenable
CVE-2025-7775 Citrix RCE Zero-day↗2025-08-26
▶
Bleepingcomputer
State hackers turn to massive ORB proxy networks to evade detection↗2024-05-22
▶
Tenable
CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway Information Disclosure Exploited in the Wild↗2023-10-18
▶
Tenable
CVE-2023-3519: Critical RCE in Netscaler ADC (Citrix ADC) and Netscaler Gateway (Citrix Gateway)↗2023-07-18
▶
Qualys
Qualys Threat Research Unit: Threat Thursdays, December 2022↗2022-12-29
▶