Loading vulnerability…
Unauthenticated RCE in Citrix ADC and Citrix Gateway SAML
CVE-2022-27518 is an improper access control vulnerability in the SAML functionality of customer-managed Citrix ADC and Citrix Gateway appliances. An unauthenticated remote attacker can exploit affected appliances configured as a SAML service provider or SAML identity provider to execute arbitrary code. Affected releases include Citrix ADC and Citrix Gateway 13.0 before 13.0-58.32, 12.1 before 12.1-65.25, and Citrix ADC 12.1-FIPS or 12.1-NDcPP before 12.1-55.291. Version 13.1 is unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation gives a remote unauthenticated attacker arbitrary code execution on the Citrix appliance, enabling authentication bypass, appliance compromise, and potential access to resources reachable through the compromised ADC or Gateway. The vulnerability has been actively exploited in targeted attacks.
If you can’t patch tonight, do this now.
Where immediate patching is not possible, disable SAML authentication on affected appliances if operationally feasible. Restrict exposure of affected appliances by placing them behind a firewall or VPN and segment them from internal networks. Review appliance configuration to identify SAML service-provider or identity-provider deployments, prioritize those systems for remediation, and conduct threat hunting for evidence of compromise.
Patch, then assume compromise.
Apply Citrix updates: upgrade Citrix ADC and Citrix Gateway 13.0 to 13.0-58.32 or later; Citrix ADC and Citrix Gateway 12.1 to 12.1-65.25 or later; and Citrix ADC 12.1-FIPS or 12.1-NDcPP to 12.1-55.291 or later. Appliances running end-of-life releases should be upgraded to a supported fixed release.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.