Citrix UniconOS: Local privilege escalation via link following

Summary

Citrix UniconOS, the endpoint OS formerly called eLux used on thin clients in desktop virtualization environments, contains a link-following flaw (CWE-59) that allows local privilege escalation. An attacker with an authenticated, low-privileged local account on the device can gain higher privileges, which may lead to full compromise of the device (CVSS v4.0 8.5, High). Remote exploitation is not possible by design, so the risk lies with shared, kiosk-type or locally accessible devices.

Affected

• Citrix UniconOS before 2607.2 (CR track), per Citrix advisory CTX697187
• Citrix UniconOS before 2603 LTSR CU2 (LTSR track)

Note: the CVE record says "before 2607 CR"; the vendor bulletin says 2607.2.

Fixed in

• Citrix UniconOS 2607.2 or later (CR track)
• Citrix UniconOS 2603 LTSR CU2 or later (LTSR track)

Confirm the exact build against the vendor advisory before rollout.

Workaround

Unknown. No vendor-documented workaround was found.

• Interim measure (own recommendation, not Citrix guidance): restrict local and physical access to affected devices.
• Interim measure (own recommendation, not Citrix guidance): review local accounts on the thin clients.

Exploitation

• Neither Citrix nor the Xen Project reports exploitation in the wild.
• No public proof of concept has been confirmed; this is not a confirmed absence.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Not listed in CISA KEV according to a third-party aggregator; the KEV catalog was not checked directly.
• EPSS 0.00154 at last check.

Our recommendation

• Inventory all UniconOS endpoints and record their versions, checking the CR and LTSR tracks separately.
• Update affected devices to 2607.2 or later (CR) or 2603 LTSR CU2 or later (LTSR).
• Until patched, restrict local and physical access and review local accounts on shared or kiosk-type thin clients.
• Check the CISA KEV catalog and the NVD entry once analysed, and monitor for changes.
• The same bulletin also covers CVE-2026-53563 and CVE-2026-53564; patch them in the same cycle.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Citrix Security Bulletin CTX697187 (vendor advisory) support.citrix.com
• Citrix Knowledge Base CTX697187 support.citrix.com
• SecurityOnline: Citrix UniconOS and XenServer updates securityonline.info
• ACN (Italy): Citrix UniconOS vulnerabilities resolved www.acn.gov.it
• Threat Intelligence CVE-2026-53562 cve.threatint.com
• Vulners: CVE-2026-53562 (EPSS) vulners.com
• TheHackerWire: CVE-2026-53562 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:43.