CVE-2022-27518 is an authentication bypass vulnerability in Citrix Application Delivery Controller (ADC) and Gateway. CISA added it to the Known Exploited Vulnerabilities catalogue on 13 December 2022, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means in Citrix ADC and Gateway
CVE-2022-27518 is an authentication bypass, so the security boundary around Citrix Application Delivery Controller and Gateway can fail even when defenders believe the front door is enforcing normal login controls. In products that sit in front of internal applications or remote access paths, that kind of flaw is dangerous because it can turn an exposed edge service into a direct entry point.
For a vulnerability of this type, the key issue is not just unauthorised sign-in, but the trust the appliance normally provides to downstream applications and users. If that trust is bypassed, an attacker may gain access to protected sessions, internal portals, or administrative functions that were supposed to be gated by authentication.
Why authentication bypass is operationally serious
Authentication bypass flaws are high value to attackers because they can remove the need for stolen credentials, password spraying, or interactive exploitation after login. On internet-facing gateways, that can compress the attack path from reconnaissance to access in a single step.
When a perimeter device is involved, the blast radius can extend beyond the appliance itself. A successful bypass may expose remote users, enterprise applications, and identity-linked sessions that rely on the device to enforce access policy. That is why exploited gateway flaws often lead to follow-on reconnaissance, session theft, or privilege escalation inside the environment.
For background on the broader vulnerability record and authoritative CVE entry, use the CVE Program alongside the NIST National Vulnerability Database, then follow the Citrix advisory for version-specific remediation details.
How organisations check exposure and prioritise response
Exposure review should start with a simple question: do you operate Citrix ADC or Gateway anywhere that is reachable from untrusted networks? Asset inventory matters here because organisations sometimes lose track of edge appliances, especially in branch, DR, or legacy remote-access estates.
Once the asset is identified, confirm whether it is internet exposed, whether it is used for remote access or application publishing, and whether the environment has compensating controls that can reduce immediate risk while patching is arranged. Vendor guidance and the CISA Known Exploited Vulnerabilities catalogue should drive priority, not generic patch queues.
For teams that need a structured remediation workflow, Vulnerability Management Guide is the most direct NHIMG reference for scoping assets, verifying exposure, and turning KEV-listed issues into time-bound remediation work.
Detection, remediation, and post-exploitation review
Where patching is delayed, organisations should use temporary mitigations from the vendor and reduce exposure by restricting access paths as tightly as possible. Edge appliances are poor places to tolerate uncertainty, because attackers can repeatedly probe public-facing services until they find a viable path.
After remediation, review logs and adjacent systems for signs that the bypass was used before the fix landed. That review should include authentication events, unusual access to protected resources, suspicious new sessions, and any signs that credentials, tokens, or administrative activity were used after the device was compromised.
Because this kind of flaw can become an initial access vector for broader compromise, compare incident indicators against known exploitation patterns in CitrixBleed 2 2025 and the Change Healthcare breach 2024 to understand how Citrix access paths can be abused after a perimeter compromise.
Risk and Threat Considerations
Because CVE-2022-27518 is a known exploited authentication bypass in an edge access product, the main risk is unauthorised entry through a control that users and operators assume is trustworthy. That creates immediate exposure to remote access abuse, session compromise, and downstream movement into internal applications.
Failure mechanism: The attacker abuses the bypass to reach functionality that should have been protected by authentication, then uses that foothold to access resources or pivot deeper into the environment.
Impact: Organisations can face account compromise, sensitive data exposure, lateral movement, and loss of trust in the gateway as an enforcement point.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed gateway flaws require prioritised identification and remediation. |
| Recommendation — Prioritise Citrix ADC and Gateway exposure, then remediate or mitigate the flaw on a tracked timeline. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and documented | Exposure assessment depends on knowing where the vulnerable gateway exists. |
| PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | An authentication bypass directly concerns enforcement of access boundaries. | |
| Recommendation — Inventory affected Citrix appliances and document where they are internet exposed. Verify that gateway access controls are restored and that any compromised sessions or credentials are revoked. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The subject is a vulnerable product requiring prompt flaw remediation or mitigation. |
| Recommendation — Remediate the Citrix flaw promptly and track compensating controls until the fix is deployed. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | The vulnerability requires structured tracking, prioritisation and treatment. |
| Recommendation — Register the Citrix issue, assign ownership, and verify remediation through follow-up checks. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed gateway flaws as perimeter incidents, not routine maintenance items. An authentication bypass on a remote-access appliance changes the organisation’s exposure model immediately, because it can affect many users and applications at once.
Practitioner takeaway: Validate whether the device is internet exposed, apply the vendor mitigation or fix as the first priority, and then review authentication and session activity for signs of prior abuse.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org