Citrix Secure Access Client vulnerabilities

6 CVEs affecting Citrix Secure Access Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0320, published 2025-06-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-3661, published 2024-05-06. High severity, CVSS 7.6. EPSS: 4.1% chance of exploitation in the next 30 days. DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over…
CVE-2023-24492, published 2023-07-11. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely execute code if a victim user opens an attacker-crafted…
CVE-2023-24491, published 2023-07-11. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been discovered in the Citrix Secure Access client for Windows which, if exploited, could allow an attacker with access to an endpoint with Standard User Account that has the…
CVE-2025-1223, published 2025-02-20. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac
CVE-2025-1222, published 2025-02-20. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac
CVE-2025-0320, published 2025-06-17. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows