High severity · published May 27, 2021
CVE-2021-22907
An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 1912 LTSR prior to CU4
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 1912 LTSR prior to CU4.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
Workspace · Citrix
before 19.12.4000; before 2105 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22907
Vendor Advisory
https://support.citrix.com/article/CTX307794
More from Workspace
9.8
CVE-2019-11634
Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
8.8
CVE-2024-6148
Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5
8.8
CVE-2020-8207
Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater service is running
7.8
CVE-2025-4879
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
7.8
CVE-2024-6286
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows