CVE-2023-24483: Privilege Escalation to NT AUTHORITY\SYSTEM on the vulnerable VDA

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-16 · updated 2026-06-17
Weakness: CWE-269

Description

A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to NT AUTHORITY\SYSTEM on a Citrix Virtual Apps and Desktops Windows VDA.

Affected products

Citrix Virtual Apps and Desktops: before 2212; 1912-cu1, 1912-cu2, 1912-cu3, 1912-cu4, 1912-cu5, 2203-cu1; 1912, 2203 — fixed in 2212
Citrix Virtual Apps and Desktops: from Citrix Virtual Apps and Desktops before 2212 — fixed in 2212, 1912 LTSR before CU6, 2203 LTSR before CU2

How to fix

Upgrade to a fixed version: Citrix Virtual Apps and Desktops 2212; Citrix Virtual Apps and Desktops 2212, 1912 LTSR before CU6, 2203 LTSR before CU2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24483 or the next vulnerability affects your stack