CVE-2025-1222: An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-20 · updated 2026-06-17

Description

An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac

Affected products

Citrix Secure Access Client for Windows: before 25.01.2 — fixed in 25.01.2
Citrix Secure Access Client for Windows: from 25 before 01.2 — fixed in 01.2

How to fix

Upgrade to a fixed version: Citrix Secure Access Client for Windows 25.01.2; Citrix Secure Access Client for Windows 01.2. Check the vendor advisory for mitigations.

References

https://support.citrix.com/s/article/CTX692679-citrix-secure-access-client-for-mac-security-bulletin-for-cve20251222-and-cve20251223?language=en_US

Get alerted when CVE-2025-1222 or the next vulnerability affects your stack