Citrix security advisory (AV26-1034)
Canada's Cyber Centre urges updates for Citrix UniconOS and XenServer flaws listed in AV26-1034.
32
CVE-2026-53563
Persistent OS Command Injection in Citrix UniconOS
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Citrix UniconOS has an OS command injection flaw (CWE-78) that can lead to persistent command execution. A local attacker who already has low privileges can trigger it without user interaction, because special elements are not properly neutralized before they are passed to an operating-system command. On the vulnerable device the impact is high for confidentiality and low for integrity and availability, with no subsequent-system impact described in the CVSS vector. The issue affects UniconOS versions before 2607.2 CR and before 2603 LTSR CU2. It is not in the CISA KEV catalog and no public proof-of-concept is known.
What to do: Upgrade Citrix UniconOS to 2607.2 CR or later, or to 2603 LTSR CU2 or later, per Citrix advisory AV26-1034. Until devices are patched, restrict local accounts to least privilege and check endpoints for unexpected persistent commands, scripts, or scheduled tasks.
| Product | Affected |
|---|---|
| Citrix UniconOS | before 2607.2 CR and before 2603 LTSR CU2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.
- Weakness
- CWE-78
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X