CVE-2025-0320: Privilege Escalation in Citrix Secure Access Client

Successful exploitation of CVE-2025-0320 allows an attacker to bypass standard access controls and execute code with SYSTEM privileges. This grants them unrestricted access to the compromised system, including the ability to install malware, steal sensitive data, modify system configurations, and potentially pivot to other systems on the network. The impact is severe, as it effectively grants the attacker full administrative control. This vulnerability is particularly concerning given the client's role in secure access, potentially allowing attackers to compromise user credentials and network resources.

1. Reserved2025-01-07
2. Published2025-06-17
3. Modified2026-02-26
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-0320 is to upgrade Citrix Secure Access Client for Windows to version 25.5.1.15 or later. Prior to upgrading, it's recommended to back up the system configuration to facilitate rollback if necessary. While a direct workaround isn't available, restricting user privileges and implementing robust network segmentation can limit the potential impact of a successful exploit. Monitor system logs for suspicious activity related to the Citrix Secure Access Client process. After upgrading, confirm the fix by attempting to execute a process with a low-privileged user account and verifying that privilege escalation is prevented.