AEGLIX vulnerability intelligence

CVE-2022-27518

CRITICAL · CVSS 9.8 · Analyzed

Published: 2022-12-13 · Updated: 2026-06-17 · Source: NVD

Vulnerability overview

Unauthenticated remote arbitrary code execution

CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.

Listed in CISA’s Known Exploited Vulnerabilities catalog.

Affected product: Citrix · Application Delivery Controller (ADC) and Gateway
Added to catalog: 2022-12-13
Required action: Apply updates per vendor instructions.
CISA remediation due date: 2023-01-03

CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.

Verify affected versions and patch availability in the vendor advisory before making changes.

cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:fips:*:*:*
From (inclusive): 12.1
Before (exclusive): 12.1-55.291
cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:ndcpp:*:*:*
From (inclusive): 12.1
Before (exclusive): 12.1-55.291
cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*
From (inclusive): 12.1
Before (exclusive): 12.1-65.25
cpe:2.3:o:citrix:application_delivery_controller_firmware:*:*:*:*:*:*:*:*
From (inclusive): 13.0
Before (exclusive): 13.0-58.32
cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*
From (inclusive): 12.1
Before (exclusive): 12.1-65.25
cpe:2.3:o:citrix:gateway_firmware:*:*:*:*:*:*:*:*
From (inclusive): 13.0
Before (exclusive): 13.0-58.32

These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.