What is the CVSS score of CVE-2022-27518?

CVE-2022-27518 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 27.7%.

Is CVE-2022-27518 being actively exploited?

Yes, CVE-2022-27518 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2022-27518?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

CVE-2022-27518

CRITICAL

Improper Control of a Resource Through its Lifetime (CWE-664)

2022-12-13 secure@citrix.com

9.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-664 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V14 - Configuration Dependency management, component inventory
Impact	Critical risk (CVSS 9.8). NSA published a specific advisory attributing exploitation to APT5 (Chinese). The targeting of telecommunications providers indicates intelligence-gathering objectives against communication infrastructure.
Exploit ScenarioDerived	APT5 identified Citrix ADC appliances configured as SAML SP or IdP in telecommunications networks. Using the zero-day, they achieved unauthenticated code execution on the appliance, then pivoted into the provider's internal network to intercept communications and access subscriber data.

Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.

Exploited in the wild (CISA KEV) No patch listed yet 27.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Citrix ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited by APT5 (Chinese state-sponsored) in zero-day attacks against critical infrastructure in December 2022.

Earlier versions of this analysis (1)

v1 Mar 26, 2026 - 11:19 CVSS 9.8

A critical unauthenticated remote code execution vulnerability in Citrix ADC and Gateway, exploited as a zero-day by APT5 (Manganese/Keyhole Panda) in December 2022 targeting telecommunications and technology organizations.

RemediationAI

Apply Citrix security updates. Review SAML configuration. Check for indicators of APT5 compromise. Conduct thorough incident response if running an affected configuration during the exploitation window.

Affected ProductsAI

Citrix ADC and Gateway (when configured as SAML SP or IdP)

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The CWE-664 improper control of a resource vulnerability in Citrix ADC/Gateway's SAML service provider or identity provider configuration allows unauthenticated remote code execution. The technical details were limited in disclosure to slow exploitation.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Feb 25, 2026 - 13:46 cisa

CISA KEV

CVE Published

Dec 13, 2022 - 17:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated remote arbitrary code execution

Executive ViewAI

Why It Matters

CVE-2022-27518 presents critical security risk rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

Threat Score

4.0/10

Composite threat intelligence

EPSS Score

27.7%

Top 4% exploitable

Threat Intel

1 source

Data Quality

3 sources

Confidence: Low

Citrix

NVD

CVE.org

CISA KEV

EPSS THREAT

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC No

EPSS 27.7%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + in CISA KEV (actively exploited), no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.