Citrix Secure Access and Endpoint Client for Windows Vulnerability Enables Privilege Escalation

Overview

Cloud Software Group has disclosed two vulnerabilities affecting Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows. The most severe vulnerability, CVE-2026-53565, allows a low-privileged local user to escalate privileges and obtain SYSTEM-level access, potentially resulting in full compromise of the affected endpoint. 

The vulnerabilities impact organizations using Citrix remote access technologies and endpoint compliance solutions. Citrix has released updates and strongly recommends immediate patching.

Threat Details

1. CVE: CVE-2026-53565?

    Description: Local Privilege Escalation allowing a low-privileged user to gain SYSTEM privileges??

    Severity: High (CVSS v4.0: 8.5)

2. CVE: CVE-2026-53566??

    Description: Out-of-Bounds Memory Read??

    Severity: Medium (CVSS v4.0: 6.8)

CVE-2026-53565

• Vulnerability Type: Improper Privilege Management (CWE-269)

• CVSS v4.0 Score: 8.5 (High)

• Attack Vector: Local

• Privileges Required: Low

• User Interaction: None

• Impact: Local users can obtain SYSTEM privileges

CVE-2026-53566

• Vulnerability Type: Out-of-Bounds Read (CWE-125)

• CVSS v4.0 Score: 6.8

• Affected Product: Citrix Secure Access Client for Windows

• Precondition: DNE (Deterministic Network Enhancer) driver not installed

Affected Products

Citrix Secure Access Client for Windows

Affected versions:

• Versions before 26.6.1.20

Affected by:

• CVE-2026-53565

• CVE-2026-53566

Citrix Endpoint Analysis Client for Windows

Affected versions:

• Versions before 26.5.1.7

Affected by:

• CVE-2026-53565

Technical Details

CVE-2026-53565

The vulnerability stems from improper privilege management within the affected Citrix Windows clients. A local user with standard permissions can exploit the issue to elevate privileges to SYSTEM, the highest privilege level available on Windows systems. Successful exploitation could provide complete control of the affected endpoint.

CVE-2026-53566

This vulnerability is caused by an out-of-bounds memory read condition. Under specific circumstances, where the DNE driver is not installed, a local user may be able to access sensitive process memory contents. 

Attack Flow

CVE-2026-53565

1. Attacker obtains local access to a Windows system.

2. Attacker logs in using a standard user account.

3. The Citrix client vulnerability is exploited.

4. Privileges are elevated to SYSTEM level.

5. Attacker gains full control of the host.

CVE-2026-53566

1. Attacker obtains low-privileged local access to a Windows system.

2. Attacker targets a system where the Deterministic Network Enhancer (DNE) driver is not installed.

3. The attacker exploits the Citrix Secure Access Client out-of-bounds memory read vulnerability.

4. The vulnerability causes the application to read memory outside the intended buffer.

5. Sensitive process memory contents are exposed and can be accessed by the attacker.

Impact

Successful exploitation of CVE-2026-53565 may allow attackers to:

• Obtain SYSTEM-level privileges.

• Execute arbitrary code with full system permissions.

• Disable or tamper with security controls.

• Install malware or ransomware.

• Access sensitive information.

• Establish persistence on the endpoint.

Successful exploitation of CVE-2026-53566 may allow attackers to:

• Read sensitive memory contents.

• Potentially obtain information useful for further attacks.

Risk Considerations

This vulnerability should be considered high risk because:

• SYSTEM-level access can be achieved from a low-privileged account.

• No user interaction is required.

• The vulnerability affects software commonly deployed across enterprise environments.

• It may enable complete compromise of affected Windows endpoints following an initial foothold.

Citrix has not reported active exploitation at the time of disclosure, but organizations should prioritize remediation due to the severity of the privilege escalation flaw.

Recommendations

• Upgrade Citrix Secure Access Client for Windows to 26.6.1.20 or later.

• Upgrade Citrix Endpoint Analysis Client for Windows to 26.5.1.7 or later.

• Verify whether vulnerable Citrix clients are installed across managed endpoints.

• Restrict local administrative rights and enforce least-privilege access controls.

• Monitor systems for unusual privilege escalation activity.

• Review endpoint security logs for abnormal SYSTEM-level process execution.

• Assess whether systems are affected by the DNE driver condition related to CVE-2026-53566.

References

• Citrix Security Bulletin CTX696734 – CVE-2026-53565 and CVE-2026-53566 

• NVD – CVE-2026-53565