CVE-2025-0320: Citrix Secure Access Client Escalation

CVE-2025-0320 Overview

CVE-2025-0320 is a local privilege escalation vulnerability in Citrix Secure Access Client for Windows. A low-privileged user on an affected endpoint can leverage the flaw to gain NT AUTHORITY\SYSTEM privileges. Citrix tracks the issue under support article CTX694724 and classifies it as a high-severity defect under CWE-269: Improper Privilege Management.

The vulnerability requires local access but no authentication or user interaction once code runs on the host. Successful exploitation results in full confidentiality, integrity, and availability impact on the compromised Windows system.

Critical Impact
Any authenticated low-privileged user on a Windows endpoint running a vulnerable Citrix Secure Access Client can escalate to SYSTEM, enabling credential theft, persistence, and lateral movement.

Affected Products

Citrix Secure Access Client for Windows
Microsoft Windows (host operating system)
Endpoints enrolled in Citrix Secure Access remote access deployments

Discovery Timeline

2025-06-17 - CVE-2025-0320 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0320

Vulnerability Analysis

The flaw resides in the Citrix Secure Access Client for Windows, an endpoint agent that establishes secure remote access tunnels to Citrix gateway infrastructure. The product runs privileged components on the host to manage network interfaces, routing, and policy enforcement. A low-privileged local user can interact with these privileged components to perform actions that should be restricted to administrators.

The attack vector is local, meaning the attacker must already have code execution as a standard user on the target machine. No network access to the Citrix gateway is required. Exploitation does not require user interaction beyond invoking the affected component.

Attackers commonly chain this class of flaw with an initial access vector such as phishing, malicious document execution, or a browser exploit. Once local code execution is achieved as a standard user, the privilege escalation provides full SYSTEM control.

Root Cause

The Citrix advisory CTX694724 attributes the issue to improper privilege management ([CWE-269]) within the Secure Access Client. A privileged process or service performs operations on behalf of an unprivileged caller without sufficient validation of the caller's authorization, the requested resource, or the integrity of the operation.

Attack Vector

Exploitation occurs entirely on the local host. An attacker holding a non-administrative account interacts with the privileged Citrix Secure Access Client component through its exposed interface, such as an inter-process communication channel, named pipe, service control surface, or file system operation performed by the privileged process. Refer to the Citrix Support Article CTX694724 for vendor-confirmed technical details and affected build numbers.

Detection Methods for CVE-2025-0320

Indicators of Compromise

Unexpected child processes spawned by Citrix Secure Access Client service binaries running as SYSTEM.
Creation of new local administrator accounts or service entries shortly after Citrix Secure Access Client activity.
Modification of files or registry keys in Citrix installation directories by non-administrative user contexts.
Anomalous loading of unsigned or user-writable DLLs into Citrix Secure Access Client processes.

Detection Strategies

Hunt for process lineage where a Citrix Secure Access Client service spawns interactive shells (cmd.exe, powershell.exe) or LOLBins.
Alert on writes to Citrix Secure Access Client program directories by user accounts outside Administrators and SYSTEM.
Correlate standard-user logon events with subsequent SYSTEM-context process creation on the same host.

Monitoring Recommendations

Forward Windows Security, Sysmon, and EDR telemetry to a centralized analytics platform for cross-host correlation.
Monitor Citrix Secure Access Client version inventory across the fleet to verify patch deployment.
Track integrity-level transitions from Medium to System originating from Citrix process trees.

How to Mitigate CVE-2025-0320

Immediate Actions Required

Apply the fixed version of Citrix Secure Access Client for Windows as documented in CTX694724.
Inventory all Windows endpoints running Citrix Secure Access Client and confirm installed build numbers.
Restrict local logon to Citrix-enabled endpoints to trusted users until patching completes.
Audit local administrator group membership and service configurations on affected hosts.

Patch Information

Citrix has released a fixed build of the Secure Access Client for Windows. Patch details, affected versions, and download instructions are published in the Citrix Support Article CTX694724. Administrators should deploy the update through their standard software distribution mechanism and verify the installed version after rollout.

Workarounds

No vendor-supplied workaround replaces the patch; upgrade to the fixed version as soon as feasible.
Limit access to affected endpoints to reduce the population of users who could exploit the flaw locally.
Apply application control policies that block unauthorized binaries from interacting with Citrix Secure Access Client IPC interfaces.
Enforce least privilege and remove unnecessary local accounts from Windows endpoints running the client.

bash

# Query installed Citrix Secure Access Client version on a Windows host
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Citrix Secure Access*" } |
  Select-Object DisplayName, DisplayVersion, Publisher