Citrix Secure Access CVE-2026-53565

Exploitation requires the attacker to already have a local, low-privileged authenticated session on a Windows host that has the vulnerable Citrix Secure Access Client (before 26.6.1.20) or Endpoint Analysis Client (before 26.5.1.7) installed - the privileged client service/agent must be present and running, which is its default installed state. Limiting factors: this is NOT remotely exploitable (AV:L), so it cannot be used for initial access and depends on the attacker first obtaining any interactive/user-level code execution on the endpoint; it only affects the Windows builds of these two specific Citrix clients below the fixed versions. No user interaction is required (UI:N) and complexity is low (AC:L), so once a local foothold exists there are no additional non-default configuration barriers indicated by the vector.

The signals are internally consistent for a serious local EoP but not a mass-exploitation emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N, VC/VI/VA:H, base 8.5) shows a low-privileged local user, no user interaction, and low attack complexity yielding complete compromise of the host - strong for post-compromise escalation. It is NOT network-reachable (AV:L), so it cannot be used for initial remote access; an attacker must already have code execution or an interactive session on the endpoint. No EPSS score was provided in the input, and the CVE is not in CISA KEV, with no POC referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a legitimate priority for hardening privileged workstations and VPN endpoints (it turns any foothold into full control), but it is a second-stage escalation issue rather than a wormable/internet-facing critical. No conflicting data was observed; the main gap is the absence of EPSS and any technical root-cause detail in the public reference.

An attacker who already has a standard (non-admin) foothold on a Windows workstation - via phishing, a stolen user session, or a malicious insider - abuses the improperly managed privileges of the Citrix Secure Access or EPA client's privileged component to execute code as SYSTEM. This gives full control of the endpoint, enabling credential theft and lateral movement toward the Citrix-protected network. No POC is publicly identified at time of analysis, but the low complexity and no-interaction profile make reliable exploitation likely once technical details are known.