What is the CVSS score of CVE-2025-0320?

CVE-2025-0320 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-0320?

CVE-2025-0320 is a local privilege escalation vulnerability in Citrix Secure Access Client for Windows that allows low-privileged users to gain SYSTEM-level access without user interaction, creating…. A patch is available.

How to fix or mitigate CVE-2025-0320?

Within 24 hours: Identify all Windows systems running Citrix Secure Access Client using asset inventory and vulnerability scanning tools; prioritize systems with high-value users or sensitive data access. Within 7 days: Deploy vendor-released patch to all affected systems in a phased approach starting with production environments; test patch in non-production environment first. Within 30 days: Verify 100% patch compliance through configuration management tools; implement application whitelisting to restrict Citrix Secure Access Client execution to signed versions only; review and restrict local administrator account assignments.

Windows CVE-2025-0320

EUVD-2025-18498 HIGH

Improper Privilege Management (CWE-269)

2025-06-17 secure@citrix.com

Privilege Escalation Citrix Windows Secure Access Client

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:38 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

25.5.1.15

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18498

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 14:15 nvd

HIGH 7.8

DescriptionCVE.org

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows

AnalysisAI

Local privilege escalation vulnerability in Citrix Secure Access Client for Windows that allows an authenticated, low-privileged user to escalate their privileges to SYSTEM level without user interaction. The vulnerability affects the Citrix Secure Access Client application on Windows systems and represents a critical threat to enterprise environments where this client is deployed, as successful exploitation grants complete system control. The CVSS 7.8 score and confirmed local attack vector indicate this is a material risk for any organization using this software, though exploitation requires prior local access to an affected system.

Technical ContextAI

This vulnerability stems from improper privilege management and access control enforcement (CWE-269), a class of flaws where code does not properly restrict which users or information systems have access to resources. The Citrix Secure Access Client for Windows is a VPN/remote access application that runs on Windows endpoints with varying privilege levels. The vulnerability likely exists in a privileged component or service (possibly running as SYSTEM or with elevated capabilities) that fails to properly validate the caller's privileges before performing sensitive operations. This could manifest as an insecure API call, unprotected inter-process communication (IPC), DLL hijacking in a privileged process, or weak file/registry permission checks. The attack surface is the Secure Access Client's core components that handle authentication, session management, or system integration.

RemediationAI

Immediate actions: (1) Consult Citrix's official security advisory and knowledge base for CVE-2025-0320 to identify patched versions; (2) Deploy the latest patched version of Citrix Secure Access Client across all Windows endpoints; (3) Prioritize systems with high-risk users (developers, contractors, remote workers) where local privilege escalation is most valuable. Interim mitigations pending patch deployment: (a) Restrict local administrative rights using Windows AppLocker or Group Policy to limit ability to run privilege escalation tooling; (b) Monitor Windows event logs (Event ID 4688 for process creation, 4624 for logons) for suspicious activity from low-privileged accounts; (c) Segregate Citrix Secure Access Client to a dedicated device or VM if possible; (d) Enforce endpoint detection and response (EDR) solutions to detect privilege escalation attempts. Verify patch deployment and rollback procedures before large-scale deployment to avoid business disruption.