Citrix Gateway Plug-In vulnerabilities

3 CVEs affecting Citrix Gateway Plug-In, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-21827, published 2022-05-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-8257, published 2020-12-14. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, lead to privilege escalation attacks
CVE-2020-8258, published 2020-12-14. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, allows an attacker to modify arbitrary files.
CVE-2022-21827, published 2022-05-26. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an attacker who has gained local access to…