CVE-2021-22927

HIGH

8.1

CVSS Score

Published: August 5, 2021 at 08:16 PM UTC

Updated: June 17, 2026 at 03:38 AM UTC

16 products affected across 1 vendorNetScaler GatewayGatewayApplication Delivery Controller Firmware

Using Citrix ADC, Citrix Gateway by N/A?

Get instant alerts when new vulnerabilities affect Citrix ADC, Citrix Gateway - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 0.8%

Description

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Application Delivery Controller Firmware · Citrix

95%

11.1 ≤ v < 11.1-65.2212.1 ≤ v < 12.1-55.23812.1 ≤ v < 12.1-62.2713.0 ≤ v < 13.0-82.45

Affected range stops below 11.1-65.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1-55.238, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1-62.27, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.0-82.45, so it looks safe — our inference, not a vendor statement

citrix-mpx-15030-50g-fips (environment) · citrix-mpx-15040-50g-fips (environment) · citrix-mpx-15060-50g-fips (environment) · citrix-mpx-15080-50g-fips (environment) · citrix-mpx-15100-50g-fips (environment) · citrix-mpx-15120-50g-fips (environment) · citrix-mpx-8905-fips (environment) · citrix-mpx-8910-fips (environment) · citrix-mpx-8920-fips (environment) · citrix-mpx-sdx-14030-fips (environment) · citrix-mpx-sdx-14060-fips (environment) · citrix-mpx-sdx-14080-fips (environment) · citrix-application-delivery-controller (same device)

Gateway · Citrix

95%

v ≥ 11.1-65.22v ≥ 12.1-55.247v ≥ 12.1-62.27v ≥ 13.0-82.4512.1 ≤ v < 12.1-62.2713.0 ≤ v < 13.0-82.45

Affected range stops below 12.1-62.27, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.0-82.45, so it looks safe — our inference, not a vendor statement

NetScaler Gateway · Citrix

95%

11.1 ≤ v < 11.1-65.22

Affected range stops below 11.1-65.22, so it looks safe — our inference, not a vendor statement

Application Delivery Controller · Citrix

60%

v ≥ 11.1-65.22v ≥ 12.1-55.247v ≥ 12.1-62.27v ≥ 13.0-82.45