Workspace CVE-2025-4879

CVSS 7.8 with AV:L (Local), AC:L (Low Complexity), PR:L (Low Privilege Required), and C:H/I:H/A:H (full confidentiality, integrity, and availability impact) indicates a high-severity local vulnerability. Attack vector is local-only (reduces internet-wide threat), but low complexity and requirement for only low-privilege user access (not unauthenticated) make exploitation feasible for many insider threats, compromised service accounts, or multi-stage attacks. The lack of user interaction (UI:N) further increases exploitability. Without confirmed EPSS score, KEV/CISA status, or public POC data, estimation suggests moderate-to-high exploitation probability due to ease of trigger and valuable end goal (SYSTEM privilege). Organizations with Citrix Workspace deployed on shared endpoints, kiosk systems, or environments with untrusted local users face elevated risk. This is NOT a low-real-risk-despite-high-CVSS issue; the local attack surface is real and privilege escalation to SYSTEM is high-impact.

A contractor or employee with standard (non-administrative) user account on a corporate Windows laptop has Citrix Workspace installed. Attacker (or malicious insider) authenticates as the low-privileged user, then exploits CVE-2025-4879 by invoking a vulnerable code path in Citrix Workspace (e.g., a custom URI handler, IPC message, or file operation) without user interaction. The vulnerability improperly grants SYSTEM privileges, allowing the attacker to execute arbitrary commands with full system access, install malware, exfiltrate sensitive data, or modify system configurations. In a multi-stage attack, initial malware compromise of the user account is followed by privilege escalation via this CVE to establish persistent, system-level access. No public POC is confirmed in provided data; however, low attack complexity suggests that POC development or discovery is likely once patch is released.