Which versions of Citrix Secure Access are affected by CVE-2026-53565?

Citrix Secure Access Client and Endpoint Analysis Client for Windows contain a local privilege escalation vulnerability (CVE-2026-53565, CVSS 8.5) that allows low-privileged local users to gain…. A patch is available.

How to fix or mitigate CVE-2026-53565?

Within 24 hours: inventory all systems running Citrix Secure Access Client before version 26.6.1.20 and Endpoint Analysis Client before version 26.5.1.7, and prioritize systems in high-value or high-trust network zones. Within 7 days: implement compensating controls including role-based access control to restrict local user privileges on affected endpoints, disable unnecessary local user accounts, enforce application-level access logging for Citrix client processes, and consider temporary air-gapping or network isolation for non-critical systems. Within 30 days: establish daily monitoring of Citrix security advisories; upon Citrix release of patches for Secure Access 26.6.1.20+ and EPA Client 26.5.1.7+, execute an expedited deployment plan within two business days given the high severity and current absence of mitigations.

Citrix Secure Access CVE-2026-53565

Q: What is the CVSS score of CVE-2026-53565?

CVE-2026-53565 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-43674 HIGH

Improper Privilege Management (CWE-269)

2026-07-14 secure@citrix.com

GHSA-4j74-6cg6-qvqf

Citrix Microsoft Privilege Escalation

8.5

CVSS 4.0 · Vendor: citrix

Severity by source

Vendor (citrix) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local low-privileged user (AV:L/PR:L) exploits a privileged client component with no interaction (AC:L/UI:N), yielding full host compromise (C/I/A:H); no scope change indicated.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (citrix).

CVSS VectorVendor: citrix

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 14, 2026 - 18:20 EUVD

Analysis Generated

Jul 14, 2026 - 13:32 vuln.today

CVE Published

Jul 14, 2026 - 13:18 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows.

This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7.

AnalysisAI

Local privilege escalation in the Citrix Secure Access Client and Citrix Endpoint Analysis (EPA) Client for Windows allows a low-privileged local user to gain higher (likely SYSTEM-level) privileges through improper privilege management (CWE-269). It affects Secure Access Client for Windows before 26.6.1.20 and Endpoint Analysis Client for Windows before 26.5.1.7, both of which run privileged Windows service/agent components on the endpoint. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Citrix rates the flaw high severity (CVSS 4.0 base 8.5) given full confidentiality, integrity, and availability impact once exploited.

Technical ContextAI

The affected software is Citrix's Windows endpoint tooling for remote/ZTNA access: the Secure Access Client (the successor to Citrix Gateway/NetScaler VPN client) and the Endpoint Analysis (EPA) Client, which performs device posture checks before granting access. Both install privileged Windows components (services/helper processes running as SYSTEM) that interact with a lower-privileged user session. The root cause is CWE-269 (Improper Privilege Management), a class where a process fails to correctly assign, drop, or enforce privilege boundaries - commonly via insecure file/directory permissions, unquoted or user-writable service binary paths, symlink/DLL loading from user-controlled locations, or an IPC/RPC interface that a privileged service exposes to unprivileged callers. The CVSS 4.0 vector (AV:L/PR:L) confirms exploitation happens locally by an already-authenticated user leveraging one of these weak privilege boundaries in the client's privileged component.

RemediationAI

Vendor-released patch: upgrade the Citrix Secure Access Client for Windows to 26.6.1.20 or later, and the Citrix Endpoint Analysis (EPA) Client for Windows to 26.5.1.7 or later, per Citrix advisory CTX696734 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696734). Because these are broadly deployed endpoint agents, push the updated clients through your standard software distribution (SCCM/Intune/Endpoint management) and, where possible, force auto-update on the Secure Access Client. Until patching completes, apply compensating controls: restrict local/interactive logon on machines running the clients to trusted users (a local user account is the prerequisite for exploitation), enforce least-privilege so fewer users can reach the vulnerable local interface, and monitor for unexpected child processes or file writes under the Citrix client install/service directories and for new privileged accounts. Note the trade-off: EPA is often mandatory for posture-based access, so you cannot simply uninstall it without breaking gateway access - patching is the only clean fix, and no server-side workaround substitutes for updating the endpoint agent.