This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Citrix fixes 2 vulnerabilities in 2 products (WIndows)
Citrix fixes 2 vulnerabilities in version 26.6.1.20 of Citrix Secure Access Client (Windows) and in version 26.5.1.7 of Citrix Endpoint Analysis Client (Windows) [1].
Allows an authenticated local attacker to escalate their privileges to SYSTEM [2].
The vulnerability is present in products:
- Citrix Secure Access Client for Windows; <26.6.1.20;
- Citrix Endpoint Analysis Client for Windows; <26.5.1.7;
CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2026-53565 at cve.org, NVD
- CWE-269: Improper Privilege Management at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Allows an authenticated local attacker to gain unauthorized access to information by reading memory beyond the bounds of the allocated buffer. The vulnerability is exploitable only on systems where the DNE driver is not installed [1].
The vulnerability is present in products:
- Citrix Secure Access Client for Windows; <26.6.1.20;
- Citrix Endpoint Analysis Client for Windows; <26.5.1.7;
CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2026-53566 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Links
By CESNET, z.s.p.o. Martin Krajči on 15. 7. 2026.