Loading story…
China-attributed APT5 actively exploited CVE-2022-27518, a critical Citrix ADC and Citrix Gateway flaw that lets an unauthenticated remote attacker execute arbitrary code and bypass authentication controls. The activity prompted a joint U.S. government cybersecurity advisory detailing threat-hunting guidance and indicators associated with exploitation.
The vulnerability affects customer-managed Citrix appliances configured as a SAML service provider or SAML identity provider; Citrix ADC and Citrix Gateway 13.1 are not affected. Organizations should urgently apply Citrix’s security updates, disable SAML authentication where operationally feasible until remediation is complete, and hunt for the published indicators of compromise.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
The NSA warned that China-attributed APT5 was actively exploiting CVE-2022-27518 in the wild. The flaw enables unauthenticated remote code execution and authentication bypass on affected Citrix ADC and Gateway appliances configured for SAML functionality.
Citrix advised customers using affected customer-managed Citrix ADC and Citrix Gateway appliances to update to fixed releases, including 12.1-65.25 or 13.0-88.16. It also recommended disabling SAML authentication where prompt updating was not feasible.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **APT5** is exploiting a newly disclosed vulnerability in **Citrix ADC** and **Citrix Gateway**, adding another high-risk edge-device intrusion case to the threat landscape. The activity highlights continued targeting of internet-facing remote access infrastructure, where successful exploitation can give attackers an initial foothold inside enterprise environments and enable follow-on espionage or broader network compromise. The reporting appeared alongside separate coverage of a ransomware attack that disrupted **Ardent Health Services**, underscoring how perimeter compromises and healthcare intrusions remain pressing concerns across sectors. While the incidents involve different threat activity, together they reflect sustained pressure on organizations to rapidly patch exposed appliances, monitor for suspicious access on remote connectivity systems, and strengthen incident response readiness for both state-linked intrusions and financially motivated attacks.
Jul 12, 2026
The Dutch National Cyber Security Centre (NCSC) warned that attackers were actively scanning for Citrix ADC and Citrix Gateway—formerly NetScaler—systems vulnerable to **CVE-2019-19781**. The flaw could allow an unauthenticated remote attacker to execute code and gain direct access to internal networks and systems; no vendor patch was available when the warning was issued, making Citrix-provided mitigations the immediate defensive measure. Organizations were urged to identify internet-exposed Citrix appliances, deploy and validate the mitigations, assess their status with Citrix’s available checking tool, and install the vendor update as soon as released. The NCSC cautioned that compromise could have occurred before mitigations were applied or where they failed, recommending specialist incident-response review for affected systems; XML files created and invoked under `vpns/portal/` could indicate attempted code execution, although their absence did not exclude intrusion.
Aug 31, 2026CVE-2025-7775, a memory overflow vulnerability in Citrix NetScaler ADC and Gateway, is being actively exploited for remote code execution and denial of service. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and additional related flaws (CVE-2025-7776, CVE-2025-8424) have also been disclosed. Organizations are urged to patch immediately and monitor for suspicious activity, as adversaries are leveraging AI-driven exploit frameworks to accelerate attacks.
Jun 29, 2026