Citrix Virtual Delivery Agent Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the Windows Virtual Delivery Agent used by Citrix Virtual Apps and Desktops, as well as Citrix DaaS. This vulnerability allows a low-privileged user to gain SYSTEM privileges. It affects Citrix Virtual Apps and Desktops versions prior to 2503, and the 2402 LTSR CU2 and earlier versions of 2402 LTSR. Notably, Citrix Virtual Apps and Desktops 2203 LTSR is not affected.

Impact

Exploitation of this vulnerability allows low-privileged users to gain SYSTEM privileges on the affected Windows system.

Remediation

Citrix recommends upgrading to Windows Virtual Delivery Agent versions that contain the fixes. For Citrix Virtual Apps and Desktops, users should upgrade to version 2503 or later. For those on the 2402 LTSR, CU1 Update 1 or CU2 Update 1 should be installed. Citrix DaaS customers can use the VDA Upgrade Service to update their Windows persistent Virtual Delivery Agents.