Protection Mechanism Failure in Citrix Netscaler ADC and Citrix Access Gateway - CVE-2022-27516
Published: November 8, 2022
Vulnerability identifier: #VU69136
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-27516
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect implementation of of the "Max Login Attempts" feature within the VPN (Gateway) and AAA virtual server. An attacker can bypass implemented security restrictions and perform a brute-force attack.
Affected software
Citrix Netscaler ADC
Citrix Access Gateway
Citrix Access Gateway
How to mitigate CVE-2022-27516
Install updates from vendor's website.
Citrix Netscaler ADC - addressed in versions 12.1-55.289, 12.1-65.21, 13.0-88.12, 13.1-33.47
Citrix Access Gateway - addressed in versions 12.1.65.21, 13.0-88.12, 13.1-33.47
Citrix Access Gateway - addressed in versions 12.1.65.21, 13.0-88.12, 13.1-33.47