Citrix security advisory (AV26-1034)
Canada's Cyber Centre urges updates for Citrix UniconOS and XenServer flaws listed in AV26-1034.
32
Vulnerability3 · 1 read
CVE-2026-53564
Path traversal file read/write in Citrix UniconOS
- CVSS 4.0
- 5.1 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-53560 is a path-traversal flaw (CWE-22) in Citrix UniconOS that can lead to arbitrary file read and write. Citrix rates it CVSS 4.0 5.1: an attacker on an adjacent network needs no privileges, user interaction is only passive, and the impact is low confidentiality and low integrity on the vulnerable system with no availability impact. It affects UniconOS builds before 2607.2 CR and before 2603 LTSR CU2. No public proof-of-concept is known and the issue is not listed in CISA KEV.
What to do: Upgrade Citrix UniconOS to 2607.2 CR or later, or to 2603 LTSR CU2 or later, and follow Citrix advisory AV26-1034. There is no known public exploit or CISA KEV listing, but the issue needs no privileges from an adjacent network, so treat unpatched thin clients as exposed until updated.
| Product | Affected |
|---|---|
| Citrix UniconOS | before 2607.2 CR and before 2603 LTSR CU2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.
- Weakness
- CWE-22
- Vector
- CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X