CVE-2026-53562

CVE-2026-53562 is an improper link resolution before file access (CWE-59) flaw in Citrix UniconOS. A local attacker with low privileges can cause the product to follow a link and access a file it should not, without user interaction. Successful exploitation can fully compromise confidentiality, integrity, and availability on the vulnerable system; impact does not extend to other systems in the CVSS score. It affects UniconOS releases before 2607 CR and before 2603 LTSR CU2. Citrix published advisory AV26-1034; there is no known public proof of concept and the issue is not listed in CISA KEV.

What to do: Upgrade Citrix UniconOS to 2607 CR or later, or to 2603 LTSR CU2 or later, as named in the advisory. Until patched, restrict local low-privileged accounts on UniconOS devices and review who can write files or create links in locations the OS later follows. No public exploit or CISA KEV listing is known; still treat unpatched endpoints as high local impact.