Citrix Workspace App for Windows - Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
Priority LOW 33CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0013 2nd percentileScored 2026-11-07
Fix Fixed Workspace App for Windows (Citrix): 2409, CU2 Hotfix 1, CU3 Hotfix 1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Citrix | Workspace App for Windows | CR to before 2409; 2402 LTSR to before CU2 Hotfix 1; 2402 LTSR to before CU3 Hotfix 1 | 2409, CU2 Hotfix 1, CU3 Hotfix 1 | Patch available | CNA |
- Workspace App for Windows VendorCitrix Affected CR to before 2409; 2402 LTSR to before CU2 Hotfix 1; 2402 LTSR to before CU3 Hotfix 1 Fixed in 2409, CU2 Hotfix 1, CU3 Hotfix 1 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:citrix:workspace:*:*:*:*:ltsr:windows:*:* | before 2402 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:workspace:*:*:*:*:-:windows:*:* | before 2409 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:workspace:2402:-:*:*:ltsr:windows:*:* | 2402 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:workspace:2402:cu1:*:*:ltsr:windows:*:* | 2402 cu1 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:workspace:2402:cu2:*:*:ltsr:windows:*:* | 2402 cu2 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:workspace:2402:cu3:*:*:ltsr:windows:*:* | 2402 cu3 | Vulnerable | Citrix |
- cpe:2.3:a:citrix:workspace:*:*:*:*:ltsr:windows:*:* Versions before 2402 Vulnerable ·Citrix
- cpe:2.3:a:citrix:workspace:*:*:*:*:-:windows:*:* Versions before 2409 Vulnerable ·Citrix
- cpe:2.3:a:citrix:workspace:2402:-:*:*:ltsr:windows:*:* Versions 2402 Vulnerable ·Citrix
- cpe:2.3:a:citrix:workspace:2402:cu1:*:*:ltsr:windows:*:* Versions 2402 cu1 Vulnerable ·Citrix
- cpe:2.3:a:citrix:workspace:2402:cu2:*:*:ltsr:windows:*:* Versions 2402 cu2 Vulnerable ·Citrix
- cpe:2.3:a:citrix:workspace:2402:cu3:*:*:ltsr:windows:*:* Versions 2402 cu3 Vulnerable ·Citrix
Remediation
- Fix · CNA Workspace App for Windows (Citrix) Fixed in 2409, CU2 Hotfix 1, CU3 Hotfix 1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-4879
- 2026-10-03 Alias added: GHSA-rj6g-gj4c-2vf5
References
More Citrix Workspace vulnerabilities
- TI-2019-08705 Citrix Workspace App before 1904 for Windows has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-06625 Improper access control in Citrix Workspace App for Windows CVSS 3.1HIGH 8.8
- TI-2024-05833 Improper privilege management in Citrix Workspace app for Windows CVSS 4.0HIGH 8.5
- TI-2023-10106 Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows CVSS 3.1HIGH 7.8
- TI-2021-05768 Improper access control in Citrix Workspace App for Windows CVSS 3.1HIGH 7.8
- TI-2022-06196 Improper access control in Citrix Workspace App for Linux CVSS 3.1HIGH 7.8
Sources
- CVE-2025-4879 · CVE Program
- CVE-2025-4879 · NVD
- FIRST EPSS
- GHSA-rj6g-gj4c-2vf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences