iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In December 2022, the NSA warned that APT5 had demonstrated the ability to exploit CVE-2022-27518 in Citrix ADC deployments. Citrix said the flaw was being exploited in the wild on unmitigated appliances. It affected certain customer-managed Citrix ADC and Gateway builds only when configured for SAML; the vendor’s fixed releases are listed below.
What was the Citrix vulnerability?
CVE-2022-27518 was an unauthenticated remote arbitrary-code-execution vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway. On a vulnerable appliance, a remote attacker could execute code without first authenticating.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Server Motherboard for Citrix NetScaler X9SPU-F-CS045 1155 Fully Tested | Buy on Amazon |
The NSA’s December 2022 advisory associated the activity with APT5, also known as UNC2630 and MANGANESE. The agency said APT5 had demonstrated capabilities against Citrix ADC deployments. This describes the NSA’s attribution and warning at that time; the supplied information does not establish that the same campaign is still active today.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Which Citrix systems were affected?
Configuration and deployment requirements
The flaw applied to customer-managed appliances running an affected release if the appliance was configured as a SAML service provider (SP) or SAML identity provider (IdP). Citrix identified these configuration entries as indicators to check:
#1 Best Overall
- Server Motherboard For Citrix NetScaler X9SPU-F-CS045 1155 Fully Tested
add authentication samlAction— SAML SP configuration.add authentication samlIdPProfile— SAML IdP configuration.
Citrix-managed cloud services and Citrix-managed Adaptive Authentication were not affected. Citrix ADC/Gateway 13.1 was also listed as unaffected.
Affected branches and fixed builds
Citrix’s affected-build guidance was branch-specific. A version earlier than the listed fixed build was affected only if the SAML configuration condition also applied.
| Product branch | Affected builds | Fixed build |
|---|---|---|
| ADC/Gateway 13.0 | Before 13.0-58.32 | 13.0-58.32 |
| ADC/Gateway 12.1 | Before 12.1-65.25 | 12.1-65.25 |
| ADC 12.1-FIPS | Before 12.1-55.291 | 12.1-55.291 |
| ADC 12.1-NDcPP | Before 12.1-55.291 | 12.1-55.291 |
| ADC/Gateway 13.1 | Not affected | Not applicable |
Citrix said releases earlier than 12.1 were end-of-life. If an appliance is still on one of those releases, the appropriate response is to move it to a supported branch, rather than rely on an unavailable fix for the old version.
How to check and respond
- Identify the deployment. Establish whether the system is a customer-managed ADC or Gateway appliance, rather than one of the Citrix-managed services excluded from the advisory.
- Check SAML configuration. Inspect the appliance configuration for
add authentication samlActionandadd authentication samlIdPProfile. Either entry indicates a relevant SAML role. - Record the product branch and running build. Compare the appliance’s version with the fixed-build table. A vulnerable build plus either SAML configuration entry warrants urgent remediation.
- Install the applicable vendor-fixed release. Use the fixed build for the appliance’s branch. For a release before 12.1, upgrade to a supported branch.
- Investigate possible compromise. Citrix reported exploitation of unmitigated appliances in the wild. Use the NSA threat-hunting guidance referenced in its advisory to investigate the appliance and its activity; do not assume that patching alone establishes whether it was previously compromised.
If SAML is enabled but an immediate upgrade cannot be completed, temporarily disabling the affected SAML configuration may reduce exposure, but can interrupt authentication flows that depend on it. Treat this as a short-term operational mitigation, not a substitute for installing the fixed release. The supplied guidance does not establish that disabling SAML removes all risk in every deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the warning says about broader network defense
A separate NSA, CISA and FBI advisory says PRC actors have exploited publicly known vulnerabilities in network providers since 2020. Its wider defensive recommendations include:
- Apply security updates promptly, especially to internet-facing network infrastructure.
- Disable ports and protocols that are not needed.
- Replace end-of-life network devices.
- Segment networks to limit the reach of a compromised device.
- Enable robust logging for internet-facing services and access to network devices.
NIST includes CVE-2022-27518 in its Known Exploited Vulnerabilities context and directs users to follow the vendor’s remediation instructions. The available information does not provide a reliable incident count, number of affected appliances, or prevalence rate for this particular campaign.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
