CVE-2021-22928: Citrix Virtual Apps And Desktops

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM.

Affected products

• Citrix Virtual Apps And Desktops: from 2006, up to and including 2106; version 1912 only
• Citrix Xenapp: version 7.15 only
• Citrix Xendesktop: version 7.15 only

Published 2021-08-05. Last modified 2026-06-17.