{"id":"CVE-2022-27510","published":"2022-11-08T21:26:10Z","modified":"2025-05-01T19:37:47Z","title":"Unauthorized access to Gateway user capabilities","vendor":"Citrix","product":"Citrix Gateway, Citrix ADC ","tier":"core","eol":null,"affectedVersions":[{"vendor":"Citrix","product":"Citrix Gateway, Citrix ADC ","versions":["0"]}],"description":{"text":"Unauthorized access to Gateway user capabilities \n","provenance":"source","from":"CVE.org"},"summary":{"text":"Citrix Gateway and Citrix ADC contain a flaw that permits unauthorized access to Gateway user capabilities. An attacker with network access to the affected appliance can exploit it without authentication or user interaction, as the flaw is an authentication bypass through an alternate path or channel.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:39Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01119,"percentile":0.66104,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-01-13","exploitedFirstSeen":"2023-01-13","ransomware":true,"evidence":[{"url":"https://www.at-bay.com/articles/likely-first-exploit-citrix-vulnerability/","date":"2023-01-13"},{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf","date":"2023-05-15"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"},{"url":"https://www.orangecyberdefense.com/fileadmin/general/pdf/Cy-Xplorer-2024.pdf","date":"2024-07-08"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"Play Ransomware","url":"https://otx.alienvault.com/pulse/63b83c0dadb77fcc68b0801f","created":"2023-01-06"},{"name":"CVE-2022-41080, CVE-2022-41082: Rapid7 Observed Exploitation of `OWASSRF` in Exchange for RCE | Rapid7 Blog","url":"https://otx.alienvault.com/pulse/63a4374ba7126114dabb85b0","created":"2022-12-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-32011","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-32011","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-11-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-27510","provenance":"source"},{"date":"2023-01-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.at-bay.com/articles/likely-first-exploit-citrix-vulnerability/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1387 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":13.22,"detail":"percentile 0.6610"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}