How do you patch or mitigate CVE-2022-27518 (Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass)?

CISA’s required action for CVE-2022-27518 is to apply updates per vendor instructions. In practice, find every instance of Citrix Application Delivery Controller (ADC) and Gateway in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

How to confirm exposure before you change anything

The first job is inventory, not tuning. You need to find every Citrix ADC and Gateway instance, confirm which ones are internet exposed, and identify where the management plane is reachable from untrusted networks. That matters because a bypass in a perimeter-facing appliance has a different blast radius from the same flaw on an isolated internal system.

Edge Device Security Guide is the right internal reference when you are mapping appliance exposure, management access, and end-of-life risk across the estate.

For prioritisation, treat any externally reachable ADC or Gateway as urgent until you know it is patched or properly mitigated. If you are still discovering shadow deployments, stale clusters, or appliances with unclear ownership, assume they are at risk until proven otherwise.

Patch, mitigate, or remove exposure

CISA’s required action is to apply updates per vendor instructions, so the preferred path is to follow Citrix guidance and remediate the affected appliances directly. When patching is feasible, do it promptly and verify the change on the live instance rather than assuming the update process completed cleanly.

If you cannot patch immediately, the practical mitigation is to remove internet exposure or take the product out of service. That is often the safer choice when the appliance is acting as a public access gateway and you have no compensating control that genuinely blocks abuse of the bypass.

CISA Known Exploited Vulnerabilities Catalog should be checked alongside the vendor advisory so you are aligned with the current remediation expectation and do not rely on stale internal notes.

NIST National Vulnerability Database is useful for cross-checking the CVE record and tracking related references while you work through the remediation ticket.

What to check after remediation and what to do if you suspect abuse

Because this flaw was used in the wild, remediation is not the end of the work. Review authentication, access, and administrative logs for the period before patching so you can look for signs of earlier exploitation, unusual sessions, or suspicious changes to gateway configuration and downstream access paths.

If you find evidence that the appliance was abused, assume the attacker may have used the bypass to reach protected resources or establish persistence through trusted access routes. In that case, expand the review to adjacent identities, sessions, and connected systems rather than treating the appliance as the only affected asset.

CitrixBleed 2 2025 is a useful comparison point for why gateway flaws often require post-patch hunting, not just a software update.

Vulnerability Management Guide supports the follow-through step: verify remediation, record exception handling if patching was delayed, and close the loop with evidence rather than assumption.

Risk and Threat Considerations

An authentication bypass on a perimeter access platform is high risk because it can turn a trusted gateway into an untrusted entry point. The main concern is not just unauthorised login, but the possibility that an attacker uses the appliance to reach internal services, bypass normal access controls, or hide initial access inside legitimate-looking traffic.

Failure mechanism: The vulnerability undermines the trust boundary on an internet-facing access device, so controls that assume the gateway is enforcing authentication can fail even when the service appears healthy.

Impact: Attackers may gain access to protected applications, pivot into the environment, or trigger follow-on compromise that is harder to detect than a direct endpoint intrusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This is a KEV-listed CVE requiring rapid exposure discovery and remediation.
Recommendation — Prioritise, remediate, and verify the affected appliances through continuous vulnerability management.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about patching and mitigating a specific exploited product flaw.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-patch log review is needed to look for prior exploitation.
Recommendation — Apply vendor remediation and track the fix through flaw remediation controls. Review authentication and access logs for indicators of earlier compromise.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This is a technical vulnerability requiring documented remediation and verification.
Recommendation — Track the flaw through technical vulnerability management until remediation is verified.

Practitioner Guidance

What to prioritise: Patch or isolate the most exposed Citrix ADC and Gateway instances first, especially those that front critical business access. If an appliance cannot be brought to a trusted state quickly, remove it from service before you accept continued exposure.

What to verify: Confirm the appliance is no longer reachable from the public internet unless that exposure is explicitly required and controlled, and confirm log retention is sufficient to inspect the pre-remediation window. A successful fix without a usable audit trail leaves you blind to earlier compromise.

Practitioner takeaway: Treat this as a gateway trust incident, not just a CVE ticket, because the right remediation decision is the one that restores confidence in the access boundary, not merely the one that installs a patch.