CVE-2025-4879: Privilege Escalation in Citrix Workspace App

Successful exploitation of CVE-2025-4879 allows an attacker with limited privileges to gain complete control over the affected Windows system. This could involve installing malware, accessing sensitive data, modifying system configurations, or establishing a persistent foothold within the network. The impact is particularly severe in environments where user accounts have limited privileges, as this vulnerability effectively bypasses those restrictions. Attackers could leverage this to move laterally within the network, compromising other systems and data.

1. Reserved2025-05-17
2. Published2025-06-17
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-4879 is to upgrade Citrix Workspace App for Windows to CU3 Hotfix 1 or later. If immediate upgrading is not possible, consider implementing least privilege principles to restrict user access and limit the potential impact of a successful exploit. While a direct workaround isn't available, monitoring for suspicious process activity and unauthorized access attempts can help detect exploitation. After upgrading, confirm the fix by attempting to trigger the privilege escalation exploit and verifying that it fails.