CVE-2025-6759: Privilege Escalation in Windows Virtual Delivery Agent

Successful exploitation of CVE-2025-6759 allows an attacker to bypass access controls and execute code with SYSTEM privileges. This grants them full administrative access to the compromised system, enabling them to install malware, steal sensitive data, modify system configurations, and potentially pivot to other systems on the network. The impact is particularly severe in environments utilizing Windows Virtual Delivery Agent for virtual desktop infrastructure (VDI) or Citrix DaaS, as a compromised agent could lead to widespread system compromise. This vulnerability shares similarities with other local privilege escalation exploits, where attackers leverage flaws in system services to gain elevated access.

1. Reserved2025-06-27
2. Published2025-07-08
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-6759 is to upgrade Windows Virtual Delivery Agent to version 2503 or later. If immediate upgrade is not feasible, consider implementing network segmentation to limit the potential blast radius of a successful exploit. Monitor system logs for suspicious activity indicative of privilege escalation attempts. While a direct workaround is unavailable, restricting user privileges and enforcing least privilege principles can reduce the potential impact. After upgrading, confirm the fix by attempting to reproduce the vulnerability with a low-privileged user account and verifying that privilege escalation is prevented.