What is the CVSS score of CVE-2025-5309?

CVE-2025-5309 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Privileged Remote Access are affected by CVE-2025-5309?

A critical remote code execution vulnerability (CVE-2025-5309) affects our Remote Support and Privileged Remote Access systems' chat functionality, allowing attackers to execute arbitrary commands on…

How to fix or mitigate CVE-2025-5309?

Within 24 hours: Disable chat functionality in RS/PRA systems and notify all users of the temporary restriction. Within 7 days: Implement network segmentation to restrict RS/PRA chat traffic, deploy WAF rules to block template injection patterns, and establish daily vulnerability scanning. Within 30 days: Monitor vendor patch availability, conduct a comprehensive audit of chat feature access logs for indicators of compromise, and develop a deployment plan for the patch upon release.

Privileged Remote Access CVE-2025-5309

EUVD-2025-18420 CRITICAL

Code Injection (CWE-94)

2025-06-16 13061848-ea10-403d-bd75-c83a022c2891

RCE Code Injection Privileged Remote Access Remote Support Beyondtrust

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18420

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 17:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution.

AnalysisAI

Server-Side Template Injection (SSTI) vulnerability in the chat feature of Citrix Remote Support (RS) and Privileged Remote Access (PRA) that enables unauthenticated remote code execution with a critical CVSS score of 9.8. The vulnerability affects the chat messaging functionality across both products with no authentication or user interaction required, allowing attackers to execute arbitrary code on affected systems. This is a critical severity issue requiring immediate patching.

Technical ContextAI

The vulnerability exists in the chat feature's template processing mechanism, specifically where user-supplied input is passed directly to a server-side template engine without proper sanitization or validation. This falls under CWE-94 (Improper Control of Generation of Code). Template injection vulnerabilities occur when an application uses a templating engine (such as Jinja2, Velocity, FreeMarker, or similar) to render user-controlled data without escaping or sandboxing. In this case, attackers can inject malicious template syntax (e.g., {{7*7}}, ${system.exec()}, or similar expressions depending on the template engine) through chat messages, which are then evaluated server-side, leading to arbitrary code execution. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N), making it trivially exploitable.

RemediationAI

Apply the latest security patch released by Citrix for both Remote Support and Privileged Remote Access products immediately. 2. If immediate patching is not possible, disable or restrict access to the chat feature at the network level using firewall rules or WAF policies until patched. 3. Implement network segmentation to limit exposure of RS/PRA instances to trusted networks only. 4. Monitor for exploitation attempts by checking chat message logs for template injection payloads (e.g., suspicious ${}, {{}}, <%, or expression syntax in chat messages). 5. Review access logs for unusual chat API endpoint requests. 6. Consider disabling the chat feature entirely in non-critical deployments pending patch deployment. Patch version information and detailed vendor advisories should be obtained directly from Citrix Security Advisory (CSA) bulletin corresponding to this CVE.