Cloud Software Group has disclosed two security vulnerabilities affecting Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows. One of the two flaws is serious enough to let a low-privileged attacker with only local access seize full SYSTEM control of an affected machine — the highest privilege level on a Windows system.

The Core Flaw: CVE-2026-53565

The more severe of the pair, tracked as CVE-2026-53565, carries a CVSS v4.0 base score of 8.5 and stems from improper privilege management (CWE-269). It affects both the Citrix Secure Access Client and the Citrix Endpoint Analysis Client for Windows simultaneously.

The vulnerability’s scoring vector indicates the attack requires only local access, low complexity, and low privileges, and needs no user interaction at all — while resulting in complete compromise of confidentiality, integrity, and availability on the affected host. In practical terms, any standard user account with local access to a machine running the vulnerable clients can escalate straight to SYSTEM.

A Second, Narrower Issue: CVE-2026-53566

The second vulnerability, CVE-2026-53566, is rated 6.8 on the CVSS v4.0 scale and involves an out-of-bounds memory read (CWE-125). Unlike the first flaw, this one is specific to the Citrix Secure Access Client for Windows and only applies under a particular condition: the Deterministic Network Enhancer (DNE) driver must not be installed on the target system.

Like CVE-2026-53565, this flaw can be exploited by a standard local user without any interaction required, though its impact is limited to confidentiality of information rather than full system takeover.

Why This Matters for Enterprise Environments

Privilege escalation bugs of this kind are especially dangerous in enterprise settings because they undermine the basic principle of least privilege that most security architectures rely on. An attacker who gains even minimal initial access — through phishing, an insider, or a compromised guest account — could use CVE-2026-53565 to jump straight to SYSTEM-level control, effectively taking over the entire endpoint.

Organizations most at risk are those where standard users have local access to machines running the affected clients: shared workstations, virtual desktop infrastructure (VDI) deployments, and bring-your-own-device setups that connect through Citrix Gateway solutions are all realistic scenarios where this flaw could be exploited.

Who Discovered It

Cloud Software Group credited Carlos Garrido of Pentraze Cybersecurity with responsibly identifying and reporting both vulnerabilities, which allowed for coordinated remediation ahead of public disclosure.

What Organizations Should Do Now

Cloud Software Group is urging immediate action for any organization running the affected clients. Recommended steps include the following:

• Update Citrix Secure Access Client for Windows to version 26.6.1.20 or later.
• Update Citrix Endpoint Analysis Client for Windows to version 26.5.1.7 or later.
• For exposure to CVE-2026-53566 specifically, check whether the DNE driver is installed using Citrix’s official documentation on gateway plugin configuration.

Because CVE-2026-53565 requires no special pre-conditions beyond standard user access, Cloud Software Group considers every deployment of the affected clients to be at risk until patched — making this a non-negotiable, high-priority update for any security team managing Citrix’s remote access stack.

The Bigger Picture

Remote access and endpoint clients sit in a uniquely sensitive spot: they’re installed widely, often on machines used by lower-trust or external users, and they typically run with elevated system privileges by design. A flaw that turns “standard user” into “SYSTEM” with zero interaction required is exactly the kind of vulnerability that ransomware operators and other opportunistic attackers tend to weaponize quickly once technical details start circulating.

Security teams should treat patch deployment as urgent, and should also audit endpoint configurations more broadly to confirm which machines are running the affected client versions and whether the DNE driver is present, so exposure to both issues can be assessed and closed out in one pass.