What is the CVSS score of CVE-2025-4879?

CVE-2025-4879 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-4879?

Citrix Workspace app for Windows contains a local privilege escalation vulnerability (CVE-2025-4879) that enables low-privileged users to gain SYSTEM-level access without user interaction, creating…. A patch is available.

How to fix or mitigate CVE-2025-4879?

Within 24 hours: Identify all Windows systems running Citrix Workspace app and document current versions; notify endpoint/workspace security teams of pending patch requirement. Within 7 days: Apply vendor-released patch to all Citrix Workspace Windows installations; prioritize systems handling sensitive data or with internet-facing exposure. Within 30 days: Complete patching across entire environment; validate patch deployment via endpoint management tools; update asset inventory with patched versions.

Windows CVE-2025-4879

EUVD-2025-18569 HIGH

Improper Privilege Management (CWE-269)

2025-06-17 secure@citrix.com

Windows Privilege Escalation Citrix Workspace

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:38 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2409

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18569

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 14:15 nvd

HIGH 7.8

DescriptionCVE.org

Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows

AnalysisAI

Local privilege escalation vulnerability in Citrix Workspace app for Windows that allows low-privileged users to gain SYSTEM-level privileges through an improper privilege management flaw (CWE-269). The vulnerability has a CVSS score of 7.8 (High) with low attack complexity and no user interaction required, making it a significant local threat. Status of KEV inclusion, active exploitation, and proof-of-concept availability cannot be confirmed from provided data, but the combination of high CVSS and local attack vector suggests meaningful real-world risk for organizations running Citrix Workspace on Windows endpoints.

Technical ContextAI

The vulnerability stems from CWE-269 (Improper Access Control / Generic Privilege Management Issue) within Citrix Workspace app for Windows. This class of weakness indicates the application fails to properly validate, enforce, or enforce privilege boundaries when transitioning from low-privileged user context to SYSTEM context. Citrix Workspace is the client-side component that enables secure access to virtual applications and desktops; the privilege escalation likely occurs through an unvalidated code path, insecure inter-process communication (IPC) mechanism, or file/registry operation that executes with elevated privileges without proper authentication of the requestor. The vulnerability affects the Windows implementation specifically, suggesting OS-level privilege model exploitation (e.g., Windows token elevation, service exploitation, or scheduled task abuse).

RemediationAI

Identify installed Citrix Workspace version on affected Windows endpoints using 'Programs and Features' or command-line tooling. 2. Consult Citrix official security advisory/CTX bulletin for CVE-2025-4879 to determine patched versions. 3. Apply vendor-supplied patch/update to Citrix Workspace app, upgrading to the fixed version. 4. If immediate patching is unavailable, implement compensating controls: (a) restrict local user privileges on endpoints where Citrix Workspace is installed, (b) use application allowlisting to limit execution of Citrix Workspace child processes, (c) monitor for suspicious process creation or privilege escalation attempts targeting Citrix Workspace processes, (d) consider disabling Citrix Workspace on endpoints where it is not essential. 5. Conduct post-patch verification via version check or hash validation. Reference official Citrix support portal (support.citrix.com) for advisory CTX-XXXXXX and download patched installer.