CVE-2026-53565

Published Jul 14, 2026

Last updated a month ago

CVSS high 8.5
VDI

Overview

Description
Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7.
Source
secure@citrix.com
NVD status
Awaiting Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
8.5
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
HIGH

Weaknesses

secure@citrix.com
CWE-269

Social media

Hype score
Not currently trending

  1. 🔴 Citrix kullanıcılarına kritik güvenlik uyarısı! Windows için Citrix Secure Access Client ve Citrix Endpoint Analysis Client yazılımlarını etkileyen CVE-2026-53565 açığı, düşük yetkili bir kullanıcının SYSTEM yetkisi elde ederek sistemi tamamen ele geçi

    @ridvanyagli

    19 Jul 2026

    117 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Citrix patched CVE-2026-53565, a Citrix Secure Access vulnerability letting local users gain SYSTEM, plus the CVE-2026-53566 out-of-bounds read bug. #Citrix #CVE202653565 #PrivilegeEscalation #Vulnerability #Windows https://t.co/QcEmRuXIPH

    @Daily_CyberSec

    17 Jul 2026

    397 Impressions

    1 Retweet

    3 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  3. HIGH SEVERITY | Citrix NetScaler EPA & Secure Access CVE-2026-53565 & CVE-2026-53566 affect Windows clients. Patch immediately. -Secure Access Client → 26.6.1.20+ -EPA Client → 26.5.1.7+ Need help? servicedesk@intrasystems.com | 866.202.0020 #Citrix #NetScaler #CVE

    @Intra_Access

    14 Jul 2026

    38 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Citrix has released a high-severity security update for Secure Access Client for Windows and Endpoint Analysis (EPA) Client. ⚠️ CVE-2026-53565: Local privilege escalation ⚠️ CVE-2026-53566: Out-of-bounds memory read Update affected versions: https://t.co/ZqywII2oNJ http

    @FerroqueSystems

    14 Jul 2026

    64 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.•CVE-2026-53412
  2. Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler•CVE-2026-13474
  3. Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.•CVE-2026-46716
  4. Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.•CVE-2026-45639
  5. Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.•CVE-2026-42913

References

Sources include official advisories and independent security research.