High severity · published Nov 16, 2020
CVE-2020-8269
An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR…
8.8
CVSS
2.7%
EPSS
No
On KEV
Description
An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Virtual Apps And Desktops · Citrix
through 2006; 1903 through 1912 · source: NVD
XE
Xenapp · Citrix
before 7.6; 7.7 before 7.15; 7.6; 7.6; 7.15; 7.15 · source: NVD
XE
Xendesktop · Citrix
before 7.6; 7.7 before 7.15; 7.6; 7.6; 7.15; 7.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8269
Patch
https://support.citrix.com/article/CTX285059
More from Virtual Apps And Desktops
8.8
CVE-2020-8283
An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes…
8.8
CVE-2020-8270
An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285871 and…
7.8
CVE-2025-6759
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent for CVAD and Citrix DaaS
7.8
CVE-2024-6151
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS
7.8
CVE-2023-24483
A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to NT AUTHORITY\SYSTEM on a Citrix Virtual Apps and Desktops…