Is CVE-2022-27518 (Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass) being exploited in the wild?

Yes. CISA added CVE-2022-27518 to its Known Exploited Vulnerabilities catalogue on 13 December 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.

What “exploited in the wild” means for this Citrix CVE

For CVE-2022-27518, the practical question is not whether the flaw exists, but whether there is evidence that attackers are actively using it. CISA’s KEV listing is the strongest public signal for that, because it reflects confirmed exploitation rather than theoretical risk. For defenders, that changes the issue from routine vulnerability management to immediate exposure triage.

In this case, the subject is an authentication bypass in Citrix Application Delivery Controller and Gateway when SAML SP or IdP configuration is in use. That matters because the vulnerability sits on a trust boundary, where successful abuse can let an attacker move from unauthenticated access to administrative control. The relevant response is therefore driven by exposure, not by the presence or absence of a published exploit string.

For broader context on how public-facing appliances become priority targets, see the Edge Device Security Guide.

Why KEV status changes the response priority

Once a vulnerability is added to KEV, it should be treated as an active attack path until proven otherwise. That does not prove every environment is compromised, but it does mean the window for safe delay is small. In practice, you should assume opportunistic scanning, rapid weaponisation, and follow-on abuse are realistic for any internet-exposed instance that matches the vulnerable condition.

The important operational nuance is that “being exploited” does not automatically mean the whole fleet is already breached. It means the issue has crossed the threshold where exploitability is no longer hypothetical, so patching, mitigation, and validation need to be prioritized together. For teams that already maintain a KEV-driven response process, this is exactly the kind of case that should jump ahead of normal remediation queues.

For a triage model built around active exploitation and emergency response, use the Zero-Day and Exploited Vulnerabilities Guide.

For authoritative status and remediation tracking, check the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database.

What practitioners should verify before trusting the environment

The first check is exposure: confirm whether the affected Citrix role is present and whether the SAML SP or IdP configuration is actually enabled in the path that reaches production users. The second check is whether the environment can be patched or mitigated immediately without breaking authentication flows. The third is whether logs, session activity, and administrator actions show signs of abuse around the KEV date or earlier.

If patching or mitigation is delayed, investigate for earlier compromise before you trust the appliance again. Focus on administrative logins, unusual configuration changes, new accounts or keys, and unexpected session behaviour that could indicate the bypass was used for post-authentication access. Where the appliance mediated privileged access, credential and session review should be treated as part of the incident question, not a separate exercise.

For a source of truth on the vulnerability record itself, use the CVE Program.

Risk and Threat Considerations

Internet-facing ADC and Gateway appliances are high-value targets because they sit in front of many users and often mediate privileged access. When an authentication bypass is exploitable in that position, the risk is not limited to initial entry, it can also expose sessions, admin control, and downstream systems that trust the appliance.

Failure mechanism: An attacker abuses the bypass in a configured SAML path to obtain access that should have been blocked, then uses that trust position to execute actions as an administrator or to pivot into connected services.

Impact: The likely consequences are unauthorized administrative access, session abuse, and broader compromise of the access tier that depends on the Citrix appliance for authentication and control.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Active exploitation of an internet-facing CVE requires monitoring for attack attempts and compromise signals.
	RS.MA-01 — Incident mitigation is performed	KEV-listed exploitation calls for immediate mitigation rather than routine backlog handling.
Recommendation — Monitor perimeter appliance activity for exploit attempts and signs of unauthorized access. Mitigate the vulnerable Citrix exposure as soon as feasible and document the exception if delay is unavoidable.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The subject is a known exploited vulnerability that demands remediation and verification.
	AU-6 — Audit Record Review, Analysis, and Reporting	Compromise checks depend on reviewing logs and access records around the exploitation window.
Recommendation — Remediate the Citrix flaw promptly and verify the corrective action on affected systems. Review appliance and authentication logs for signs of bypass, privilege abuse, and unusual administration.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	Known exploited CVEs require vulnerability management, prioritization, and remediation control.
Recommendation — Prioritize and track remediation of the Citrix vulnerability through formal technical vulnerability management.

Practitioner Guidance

What to prioritise: Treat KEV-listed authentication bypasses on perimeter appliances as urgent because the business impact is often disproportionate to the number of affected hosts. The appliance may be only one box, but it can govern access for many users and multiple downstream systems.

What to verify: Confirm the exact deployment mode, the presence of SAML SP or IdP configuration, and whether the appliance is exposed in production rather than lab or test environments. Then check whether logs and administrative activity align with normal change windows.

Decision rule: If you cannot patch immediately, assume the device may already have been probed and preserve evidence before making disruptive changes. Do not wait for confirmation of exploitation before reviewing sessions, admin actions, and dependent systems.

Practitioner takeaway: The key judgment is to treat KEV inclusion as an operational exploit signal, not a theoretical notice, and to validate both compromise and trust boundary impact before declaring the appliance safe.