Citrix UniconOS EUVD-2026-98896

Requires local access to a UniconOS device with at least low privileges (PR:L) and the ability to create or control a symbolic link at a filesystem location that a more-privileged UniconOS process subsequently accesses without safe link resolution; no user interaction is needed (UI:N). Limiting factors: exploitation cannot be performed remotely (AV:L) and depends on an attacker already having an authenticated/low-privileged foothold on the endpoint, which substantially narrows realistic exposure to insiders or attackers who have already landed on the device. Affected builds are UniconOS before 2607 CR and before 2603 LTSR CU2; patched releases remove exposure.

This is a locally-exploitable link-following flaw (CWE-59) in Citrix UniconOS with a CVSS 4.0 base score of 8.5 (vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). The high score is driven by full compromise of confidentiality, integrity, and availability (VC:H/VI:H/VA:H) rather than by ease of reach: the attack vector is LOCAL (AV:L) and requires existing low privileges (PR:L), so this is not a remotely-reachable, unauthenticated issue despite the high number. No EPSS score, KEV listing, or public POC is present in the supplied data, meaning there is no signal of active or imminent widespread exploitation - exploitation status is 'no public exploit identified at time of analysis'. SSVC-style reading: exploitation is not observed, the technical impact is total, but automatability is low because an attacker must already have a local foothold and win a link-resolution race/placement. CONFLICT TO NOTE: the input 'Information Disclosure' tag understates the impact - the CVSS vector asserts VI:H and VA:H (integrity and availability), so this is a read-and-write/tamper and potential privilege-escalation issue, not merely disclosure; treat the tag as incomplete. Net: a genuine high-severity local privilege/integrity flaw worth patching on affected UniconOS endpoints, but a lower real-world priority than a network-facing bug absent any exploitation evidence.

A low-privileged local user (or a process they control) on a UniconOS thin-client endpoint plants a symbolic link at a path that a higher-privileged UniconOS component later accesses without safely resolving links. When the privileged operation follows the attacker's link, it reads, overwrites, or creates a file outside the intended location, letting the attacker disclose protected data or tamper with system files to escalate privileges. No public exploit code is identified at time of analysis, and the local attack vector plus required low privileges mean the attacker needs a prior foothold on the device.