Read the docs
TI-2022-10525 Aliases CVE-2022-27512GHSA-jgxv-3vwf-pphp

Use after free in Citrix Application Delivery Management

Priority LOW 26CWE-664Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.

Why it matters now

EPSS 0.01015 63rd percentileScored 2026-11-07
Fix Fixed Citrix Application Delivery Management (Citrix ADM) (Citrix): 13.1-21.53, 13.0-85.19

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CitrixCitrix Application Delivery Management (Citrix ADM)before 13.1-21.53; before 13.0-85.1913.1-21.53, 13.0-85.19Patch availableCNA
  • Citrix Application Delivery Management (Citrix ADM) VendorCitrix Affected before 13.1-21.53; before 13.0-85.19 Fixed in 13.1-21.53, 13.0-85.19 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:citrix:application_delivery_management:*:*:*:*:*:*:*:*before 13.0-85.19; 13.1 to before 13.1-21.53VulnerableCitrix
  • cpe:2.3:a:citrix:application_delivery_management:*:*:*:*:*:*:*:* Versions before 13.0-85.19; 13.1 to before 13.1-21.53 Vulnerable ·Citrix

Remediation

  • Fix · CNA Citrix Application Delivery Management (Citrix ADM) (Citrix) Fixed in 13.1-21.53, 13.0-85.19

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Citrix Application Delivery Management (Citrix ADM) 13.0-85.19, 13.1-21.53

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-10524 Improper access control in Citrix Application Delivery ManagementPriority MEDIUM 50
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27512
  2. 2026-10-03 Alias added: GHSA-jgxv-3vwf-pphp

References

Advisory 1

  • TI-2022-10524 Improper access control in Citrix Application Delivery Management CVSS 3.1HIGH 8.1
  • TI-2019-06973 Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control. CVSS 3.0CRITICAL 10.0
  • TI-2019-12963 Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control. CVSS 3.1HIGH 8.8
  • TI-2021-05781 Improper access control in Citrix ADC, Citrix Gateway CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences