CVE-2007-2850

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-05-24 · updated 2026-06-16

Description

The Session Reliability Service (XTE) in Citrix MetaFrame Presentation Server 3.0, Presentation Server 4.0, and Access Essentials 1.0 and 1.5, allows remote attackers to bypass network security policies and connect to arbitrary TCP ports via a modified address:port string.

Affected products

Citrix Access Essentials: 1.0, 1.5 (and their updates)
Citrix Metaframe: 3.0, 4.0 (and their updates)

References

http://fortconsult.net/files/fortconsult.dk/citrix_advisory.pdf
http://secunia.com/advisories/25371
http://support.citrix.com/article/CTX112964
http://www.securitytracker.com/id?1018098
http://www.vupen.com/english/advisories/2007/1918
https://exchange.xforce.ibmcloud.com/vulnerabilities/34448
http://fortconsult.net/files/fortconsult.dk/citrix_advisory.pdf
http://secunia.com/advisories/25371
http://support.citrix.com/article/CTX112964
http://www.securitytracker.com/id?1018098
http://www.vupen.com/english/advisories/2007/1918
https://exchange.xforce.ibmcloud.com/vulnerabilities/34448

Get alerted when CVE-2007-2850 or the next vulnerability affects your stack