Citrix Cloud CVE-2025-66391

The attacker must already possess a valid Citrix Cloud identity with at least read-only access to the target tenant (CVSS PR:L) - this is the key limiting factor: it is not exploitable by fully unauthenticated outsiders. Given that foothold, no additional special configuration is required; the flaw is present in the default workflow-authorization behavior of the platform, exploited over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Concretely, the abuse targets account-management workflows such as password reset, where the attacker supplies their own email address to receive the one-time password. Exploitation is bounded to tenants where read-only roles are granted to semi-trusted users, and SSVC marks it non-automatable, so it cannot be reliably mass-exploited.

The signals are mixed and warrant nuance. The supplied CVSS is 8.8 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H), reflecting network-reachable, low-complexity abuse by an already-authenticated low-privilege user with high impact. SSVC reinforces meaningful concern: Technical Impact is 'total' and exploit maturity is 'poc', but Automatable is 'no', meaning it cannot be reliably mass-exploited at scale and requires a valid read-only foothold per target tenant. EPSS is low (0.38%, 30th percentile) and the CVE is NOT in CISA KEV, so despite the public PoC there is no confirmed active or widespread exploitation - consistent with a targeted, insider-or-post-compromise abuse pattern rather than internet-wide scanning. One caveat: the input's A:H (availability) is not clearly supported by the description, which centers on unauthorized initiation of write operations and OTP disclosure (confidentiality/integrity); the availability rating appears inflated. Net: a genuine and serious authorization flaw for any tenant that grants read-only access to semi-trusted users, but the PR:L prerequisite and non-automatable nature place it below drop-everything, internet-wide urgency.

An organization grants a contractor or junior analyst a read-only Citrix Cloud role for monitoring. Using the publicly available PoC (github.com/mandeepsohal/CVE-2025-66391), that user initiates a password-reset workflow for a higher-privileged administrator account and specifies an attacker-controlled email as the OTP destination; upon receiving the one-time password they complete the reset and seize the admin account. Given AC:L and no user interaction, the action is straightforward once a valid read-only session exists.