The security vulnerability, tracked as CVE-2022-27518, is caused by incorrect access restrictions on systems configured as SAML SP or SAML IdP. An unauthenticated, remote threat actor can gain unauthorized access to the system and execute arbitrary code.
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability;
- Citrix ADC And Citrix Gateway 13.0, Before 13.0-58.32
- Citrix ADC And Citrix Gateway 12.1, Before 12.1-65.25
- Pre 12.1-55.291 Citrix ADC 12.1-FIPS
- 1-55.291 Pre-Citrix ADC 12.1-NDcPP
Citrix ADC and Citrix Gateway version 13.1 are not affected by the vulnerability. In addition, the vulnerability is actively exploited by threat actors. The following scripts specify whether the Citrix ADC or Citrix Gateway is configured as SAML SP or SAML IdP. If any of these scripts are present in the ns.conf file and the version is affected, the application needs to be updated;
- Add Authentication SamlIdPProfile
- Add Authentication SamlAction
It is recommended that users using vulnerable versions and configurations immediately apply the published updates in order not to be the target of attacks that can be carried out using the vulnerability. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action regarding the vulnerability.
Later NetScaler flaws exploited in the wild have their own pages: Citrix Bleed (CVE-2023-4966), CVE-2023-3519 and Citrix Bleed 2 (CVE-2025-5777).
Who is exploiting CVE-2022-27518?
The NVD entry for CVE-2022-27518 describes it as unauthenticated remote arbitrary code execution and scores it 9.8 (critical). It was published on 13 December 2022, and CISA added it to its Known Exploited Vulnerabilities catalog on the same day, with a due date of 3 January 2023 for US federal agencies to apply the vendor updates. Security Affairs reported that the NSA published an advisory the same day. The NSA attributed the activity to the China-linked group APT5, also tracked as UNC2630 and MANGANESE. Citrix said it knew of a small number of targeted attacks in the wild.
Is my appliance at risk?
Only appliances set up as a SAML service provider (SP) or SAML identity provider (IdP) are exposed, and only on the affected builds listed above. Look for the two commands in the ns.conf file as described earlier. If either one is present and the version is affected, update. The Citrix security bulletin is the vendor source for the fixed builds. Security Affairs notes that the advisory says there is no workaround, so installing the fixed build is the only fix.
What should defenders do next?
- Install the fixed builds on every affected ADC and Gateway as soon as you can.
- Treat any device that ran an affected build with SAML configured as possibly compromised, because exploitation started before the patch.
- Review logs and the device for signs of access you did not expect, and use indicators from the NSA guidance if you have it.
- Keep these appliances off the open internet where you can, or place them behind additional controls.