Summary
generated automatically from NVD dataCVE-2022-27518 affects Citrix Application Delivery Controller firmware and Citrix Gateway firmware, with NVD bounds covering versions 12.1 and 13.0 builds up to 55.291, 65.25 and 58.32 depending on the branch. The flaw, classified under CWE-664, allows an unauthenticated remote attacker to execute arbitrary code. It is rated CRITICAL with a CVSS v3.1 score of 9.8, and CISA lists it in its KEV catalog, added 2022-12-13, which confirms active exploitation.
NVD description
Unauthenticated remote arbitrary code execution
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2022-12-13. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2023-01-03
EPSS · FIRST.org
6.9%probability of exploitation in the next 30 days
Higher than 93% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 13 déc. 2022
- Updated
- 17 juin 2026
- Status
- Analyzed
- Source
- secure@citrix.com
Affected products
Weaknesses (CWE)
References (3)
- https://support.citrix.com/article/CTX474995Vendor Advisory
- https://support.citrix.com/article/CTX474995Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27518US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-664
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.