Citrix Windows Client Flaw Lets Local Users Gain SYSTEM Access

Citrix has patched two Windows client vulnerabilities, including a high-severity privilege escalation flaw that can let a low-privileged local user gain SYSTEM access.

The more serious vulnerability, CVE-2026-53565, affects Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows. A second flaw, CVE-2026-53566, can expose sensitive memory in Citrix Secure Access Client under a specific configuration.

Organizations should update Secure Access Client to version 26.6.1.20 or later and Endpoint Analysis Client to version 26.5.1.7 or later.

Citrix published fixes for two Windows client flaws

Citrix disclosed the vulnerabilities in security bulletin CTX696734 on July 14, 2026. The company provided updated client versions that address both issues.

The official Citrix security bulletin identifies CVE-2026-53565 as an improper privilege management vulnerability and CVE-2026-53566 as an out-of-bounds memory read.

Both vulnerabilities require local access and low privileges. They have low attack complexity, require no user interaction, and do not depend on a victim opening a file or approving a prompt.

Vulnerability	Affected product	Impact	CVSS 4.0
CVE-2026-53565	Secure Access Client and Endpoint Analysis Client	Privilege escalation to SYSTEM	8.5, High
CVE-2026-53566	Secure Access Client	Sensitive memory disclosure	6.8, Medium

CVE-2026-53565 grants SYSTEM privileges

CVE-2026-53565 results from improper privilege management, classified as CWE-269. A standard Windows user who already has local access can exploit the flaw to elevate privileges to SYSTEM.

The National Vulnerability Database entry for CVE-2026-53565 lists a Citrix-assigned CVSS 4.0 score of 8.5. NIST has not yet added its own independent severity assessment.

The CVSS vector shows that exploitation requires local access and low privileges. It has low complexity, no additional attack requirements, and no user interaction.

Successful exploitation can have a high impact on confidentiality, integrity, and availability. The flaw does not directly affect other systems, but SYSTEM access gives the attacker extensive control over the compromised Windows endpoint.

What SYSTEM access allows an attacker to do

SYSTEM represents one of the most powerful security contexts on Windows. It has broader local permissions than a typical administrator account and runs many core operating-system services.

An attacker who reaches SYSTEM could potentially:

• Access protected files and credentials
• Install malware or remote-access tools
• Modify security and system configurations
• Disable endpoint protection software
• Create persistent services or scheduled tasks
• Monitor other users on the device
• Use the endpoint to attack connected systems

The flaw does not provide remote initial access by itself. An attacker must first obtain a local foothold through another method, such as stolen credentials, malicious software, physical access, or a compromised standard user account.

CVE-2026-53566 can expose sensitive memory

The second vulnerability, CVE-2026-53566, is an out-of-bounds read classified as CWE-125. It affects only Citrix Secure Access Client for Windows.

An out-of-bounds read occurs when software accesses memory outside the area it should process. This can expose information from adjacent memory locations to an attacker.

The NVD record for CVE-2026-53566 lists a Citrix-assigned CVSS 4.0 score of 6.8. The documented impact concerns confidentiality, with no listed effect on integrity or availability.

Exploitation requires a standard local user account and no user interaction. However, the vulnerable condition exists only when the DNE driver is not installed on the Windows system.

Which Citrix versions are affected?

The vulnerabilities affect Windows client versions released before the fixed builds. Citrix has not identified equivalent exposure in macOS clients through this advisory.

Product	Affected versions	Fixed version	Applicable CVEs
Citrix Secure Access Client for Windows	Versions before 26.6.1.20	26.6.1.20 or later	CVE-2026-53565 and CVE-2026-53566
Citrix Endpoint Analysis Client for Windows	Versions before 26.5.1.7	26.5.1.7 or later	CVE-2026-53565

CVE-2026-53565 does not require the DNE condition. Administrators should therefore consider every supported Windows endpoint running an older affected client vulnerable until they install the update.

Why CVE-2026-53565 poses an enterprise risk

The CVE-2026-53565 vulnerability record does not describe a remote attack path. However, local privilege escalation vulnerabilities often support multi-stage attacks.

An attacker may first compromise a standard user through phishing, credential theft, malicious software, or another vulnerability. The attacker could then use a privilege escalation flaw to gain deeper control over the endpoint.

Organizations should prioritize systems where many users have local access or where endpoints connect to sensitive corporate resources. Higher-priority environments may include:

• Shared Windows workstations
• Virtual desktop infrastructure
• Contractor and third-party endpoints
• Bring-your-own-device deployments
• Privileged administrator workstations
• Systems with access to sensitive internal applications

How to check exposure to CVE-2026-53566

Administrators should inventory Citrix Secure Access Client installations and identify their installed versions. Any build older than 26.6.1.20 requires an update.

Teams assessing CVE-2026-53566 exposure must also determine whether the DNE driver is present. Systems without the driver meet the documented configuration requirement for exploitation.

The DNE check should support patch prioritization rather than replace the update. Installing Secure Access Client 26.6.1.20 or later addresses the vulnerability regardless of the current driver configuration.

How organizations should respond

Citrix customers should deploy the fixed client versions as soon as their change-management procedures allow.

1. Inventory Citrix Windows clients across managed endpoints.
2. Identify Secure Access Client builds older than 26.6.1.20.
3. Identify Endpoint Analysis Client builds older than 26.5.1.7.
4. Deploy the fixed versions to affected systems.
5. Confirm the updated versions after installation.
6. Check DNE driver status when prioritizing CVE-2026-53566 exposure.
7. Restrict local access on systems that cannot receive the update immediately.
8. Monitor affected endpoints for suspicious privilege escalation activity.

Security teams should also review endpoint telemetry for unexpected SYSTEM-level processes, newly created services, scheduled tasks, security-tool changes, and unusual access to protected files.

No active exploitation has been reported

Public vulnerability records did not identify known exploitation when the flaws were disclosed. They also did not list public exploit code or connect the vulnerabilities to a known threat group.

The lack of observed exploitation does not remove the need to update. Citrix has now disclosed the affected products, vulnerable version ranges, attack requirements, and impact, giving researchers and attackers useful information for further analysis.

Organizations should focus on patching instead of waiting for evidence of active attacks. CVE-2026-53565 requires no special configuration beyond local low-privileged access to a vulnerable system.

Citrix credits Pentraze researcher

Cloud Software Group credited Carlos Garrido of Pentraze Cybersecurity with discovering and responsibly reporting the vulnerabilities.

Coordinated disclosure allowed Citrix to prepare updated client versions before releasing technical information publicly. Administrators can find the official remediation details in Citrix bulletin CTX696734.

Customers should update both products where they appear together. Updating only Secure Access Client will not protect a separate vulnerable Endpoint Analysis Client installation from CVE-2026-53565.

FAQ