What is the CVSS score of CVE-2025-66391?

CVE-2025-66391 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Citrix Cloud are affected by CVE-2025-66391?

Citrix Cloud contains a critical access control vulnerability (CVE-2025-66391) where publicly available exploit code exists that allows read-only users to execute privileged administrative workflows,…

Is there a public PoC exploit available for CVE-2025-66391?

Yes, a public proof-of-concept exploit is available for CVE-2025-66391. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-66391?

Within 24 hours: Inventory all Citrix Cloud instances and document all users holding read-only permissions; enable comprehensive audit logging for workflow initiations and password-reset operations to detect privilege escalation attempts in real time. Within 7 days: Implement compensating controls by strictly limiting read-only account assignments to essential personnel, enforce multi-factor authentication on all password-reset workflows, and configure network access controls to restrict administrative function access. Within 30 days: Contact Citrix support to confirm patch availability and release timeline for CVE-2025-66391; evaluate risk mitigation options including workload isolation or transition planning until a vendor patch becomes available.

Citrix Cloud CVE-2025-66391

HIGH

Improper Access Control (CWE-284)

2026-06-17 mitre

Citrix Authentication Bypass N A

8.8

CVSS 3.1 · CISA-ADP

Severity by source

CISA-ADP PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Requires a valid read-only account so PR:L; network/low-complexity with no UI; high confidentiality (OTP leak) and integrity (unauthorized writes/account takeover), but no direct availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from CISA-ADP.

CVSS VectorCISA-ADP

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:34 vuln.today

CVE Published

Jun 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 00:00 cve.org

HIGH 8.8

DescriptionCVE.org

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-controlled email address when the attacker attempts to reset the password of a user account.

AnalysisAI

Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only permissions initiate privileged write workflows they should be barred from. Because the platform enforces authorization at the wrong step, a low-privilege operator can, for example, kick off a password-reset flow and have the one-time password delivered to an attacker-controlled email address, enabling takeover of other accounts. Publicly available exploit code exists (MITRE-reported, GitHub PoC), though there is no evidence of active exploitation and the EPSS probability is low at 0.38% (30th percentile).

Technical ContextAI

This is a CWE-284 Improper Access Control weakness in the Citrix Cloud management/identity platform, a multi-tenant SaaS console for administering Citrix DaaS, NetScaler, and related services. The defect is an authorization gap in the workflow state machine: the platform checks a user's role when a write operation is finalized but not when the workflow is initiated, so a read-only role can trigger the sensitive first step (e.g., issuing a password-reset OTP). The CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), which is expected for a vendor-hosted cloud service that has no versioned on-prem software artifact - the affected surface is the live Citrix Cloud tenant rather than a downloadable product build.

RemediationAI

Because Citrix Cloud is a vendor-operated SaaS platform, the authoritative fix is applied server-side by Citrix - Patch available per vendor advisory at the service level; no customer-installable version applies. Administrators should confirm with Citrix support or the Trust/Security portal that their tenant is running the corrected authorization logic (monitor https://citrix.cloud.com/ and Citrix security bulletins for the specific remediation notice, which was not present in the supplied references). As compensating controls until confirmation, audit and minimize read-only role assignments, revoke read-only access from untrusted or unnecessary users, and enable/review administrative activity logging to detect anomalous password-reset or workflow-initiation events; where possible require step-up MFA on account-recovery flows so a leaked OTP alone cannot complete takeover. Trade-off: tightening read-only grants may disrupt legitimate auditors or monitoring integrations, so scope changes to non-essential accounts first.