What’s Vulnerable › Vulnerabilities

CVE-2020-8269

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-16 · updated 2026-06-17
• Weakness: CWE-269

Description

An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9

Affected products

• Citrix Virtual Apps and Desktops: through 2006; from 1903 through 1912
• Citrix Xenapp: before 7.6; from 7.7 before 7.15; 7.6-cu8, 7.15-cu6; 7.6, 7.15 — fixed in 7.6, 7.15
• Citrix Xendesktop: before 7.6; from 7.7 before 7.15; 7.6-cu8, 7.15-cu6; 7.6, 7.15 — fixed in 7.6, 7.15
• Citrix Virtual Apps and Desktops: 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9

How to fix

Upgrade to a fixed version: Citrix Xenapp 7.6, 7.15; Citrix Xendesktop 7.6, 7.15. Check the vendor advisory for mitigations.

References

• https://support.citrix.com/article/CTX285059
• https://support.citrix.com/article/CTX285059

Get alerted when CVE-2020-8269 or the next vulnerability affects your stack