# cve.now: Citrix

The newest entries naming Citrix as an affected vendor (up to 200), of 46 in all, 5 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-53564](https://cve.now/CVE-2026-53564.md): Arbitrary file read and write (CVSS 5.1)
- [CVE-2026-53563](https://cve.now/CVE-2026-53563.md): Persistent Command Execution (CVSS 6.9)
- [CVE-2026-84419](https://cve.now/CVE-2026-84419.md): Out-of-Bounds Write (CVSS 6.8)
- [CVE-2026-53562](https://cve.now/CVE-2026-53562.md): Local Privilege Escalation (CVSS 8.5)
- [CVE-2026-78547](https://cve.now/CVE-2026-78547.md): Out-of-Bounds Write (CVSS 4.4)
- [CVE-2026-18751](https://cve.now/CVE-2026-18751.md): Citrix Workspace App for Mac Security Bulletin for CVE-2026-18751 (CVSS 5.2)
- [CVE-2026-53566](https://cve.now/CVE-2026-53566.md): Out-of-bounds memory read (CVSS 6.8)
- [CVE-2026-53565](https://cve.now/CVE-2026-53565.md): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 8.5)
- [CVE-2025-6759](https://cve.now/CVE-2025-6759.md): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 7.3)
- [CVE-2025-0320](https://cve.now/CVE-2025-0320.md): Citrix Secure Access - Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 8.6)
- [CVE-2025-4879](https://cve.now/CVE-2025-4879.md): Citrix Workspace App for Windows - Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 7.3)
- [CVE-2025-1223](https://cve.now/CVE-2025-1223.md): An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data (CVSS 5.8)
- [CVE-2025-1222](https://cve.now/CVE-2025-1222.md): An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data (CVSS 5.8)
- [CVE-2024-8068](https://cve.now/CVE-2024-8068.md): Privilege escalation to NetworkService Account access (CVSS 5.1, KEV)
- [CVE-2024-7890](https://cve.now/CVE-2024-7890.md): Local privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 5.4)
- [CVE-2024-7889](https://cve.now/CVE-2024-7889.md): Local privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 7.0)
- [CVE-2024-6677](https://cve.now/CVE-2024-6677.md): Privilege escalation in uberAgent (CVSS 7.3)
- [CVE-2024-6149](https://cve.now/CVE-2024-6149.md): Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5 (CVSS 4.8)
- [CVE-2024-6148](https://cve.now/CVE-2024-6148.md): Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5 (CVSS 5.3)
- [CVE-2024-6150](https://cve.now/CVE-2024-6150.md): A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning (CVSS 4.8)
- [CVE-2024-6286](https://cve.now/CVE-2024-6286.md): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 8.5)
- [CVE-2024-6151](https://cve.now/CVE-2024-6151.md): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 8.5)
- [CVE-2024-5661](https://cve.now/CVE-2024-5661.md): Potential Denial of Service affecting XenServer and Citrix Hypervisor (CVSS 6.0)
- [CVE-2024-2049](https://cve.now/CVE-2024-2049.md): Server-Side Request Forgery (SSRF) (CVSS 6.5)
- [CVE-2023-4966](https://cve.now/CVE-2023-4966.md): Unauthenticated sensitive information disclosure (CVSS 9.4, KEV)
- [CVE-2023-3467](https://cve.now/CVE-2023-3467.md): Privilege Escalation to root administrator (nsroot) (CVSS 8.0)
- [CVE-2023-3466](https://cve.now/CVE-2023-3466.md): Reflected Cross-Site Scripting (XSS) (CVSS 8.3)
- [CVE-2023-3519](https://cve.now/CVE-2023-3519.md): Unauthenticated remote code execution (CVSS 9.8, KEV)
- [CVE-2023-24492](https://cve.now/CVE-2023-24492.md): A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely (CVSS 9.6)
- [CVE-2023-24491](https://cve.now/CVE-2023-24491.md): A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with acc (CVSS 7.8)
- [CVE-2023-24489](https://cve.now/CVE-2023-24489.md): A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthent (CVSS 9.8, KEV)
- [CVE-2023-24490](https://cve.now/CVE-2023-24490.md): Users with only access to launch VDA applications can launch an unauthorized desktop (CVSS 6.3)
- [CVE-2023-24487](https://cve.now/CVE-2023-24487.md): Arbitrary file read (CVSS 6.3)
- [CVE-2023-24488](https://cve.now/CVE-2023-24488.md): Cross site scripting (CVSS 6.1)
- [CVE-2023-24486](https://cve.now/CVE-2023-24486.md): Local user access to a system where another user is utilizing a vulnerable version of Citrix Workspace App for Linux to launch published desktops and applications (CVSS 5.5)
- [CVE-2023-24485](https://cve.now/CVE-2023-24485.md): Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows (CVSS 7.8)
- [CVE-2023-24484](https://cve.now/CVE-2023-24484.md): A malicious user can cause log files to be written to a directory that they do not have permission to write to. (CVSS 5.5)
- [CVE-2023-24483](https://cve.now/CVE-2023-24483.md): Privilege Escalation to NT AUTHORITY\\SYSTEM on the vulnerable VDA (CVSS 7.8)
- [CVE-2022-27518](https://cve.now/CVE-2022-27518.md): Unauthenticated remote arbitrary code execution (CVSS 9.8, KEV)
- [CVE-2022-27516](https://cve.now/CVE-2022-27516.md): User login brute force protection functionality bypass (CVSS 5.3)
- [CVE-2022-27510](https://cve.now/CVE-2022-27510.md): Unauthorized access to Gateway user capabilities (CVSS 9.8)
- [CVE-2022-27513](https://cve.now/CVE-2022-27513.md): Remote desktop takeover via phishing (CVSS 8.3)
- [CVE-2022-27512](https://cve.now/CVE-2022-27512.md): Temporary disruption of the ADM license service (no CVSS)
- [CVE-2022-27511](https://cve.now/CVE-2022-27511.md): Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password (no CVSS)
- [CVE-2022-27503](https://cve.now/CVE-2022-27503.md): Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9 (no CVSS)
- [CVE-2022-26355](https://cve.now/CVE-2022-26355.md): Citrix Federated Authentication Service (FAS) (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/citrix
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.