CVE-2002-2426: Citrix Access Essentials

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Essentials 1.0 through 2.0 allows remote attackers to execute arbitrary published applications, and possibly other programs, as authenticated users via the InitialProgram key in an ICA connection. NOTE: some of these details are obtained from third party information.

Affected products

• Citrix Access Essentials: version 1.0 only; version 1.5 only; version 2.0 only
• Citrix Metaframe Presentation Server: version 3.0 only
• Citrix Presentation Server: version 4.0 only; version 4.5 only

Published 2002-12-31. Last modified 2026-06-16.