CVE-2022-27518 exploited in the wild by APT5: everything you need to know

**CVE-2022-27518** is a zero-day unauthenticated remote code execution vulnerability in Citrix ADC/Citrix Gateway that has been observed exploited in the wild by the China-attributed APT5; Citrix and the NSA published advisories and detection/hunting guidance, affected customers should update to patched builds or disable SAML, and exploitation is limited to customer-managed appliances with SAML SP/IdP configurations.