CVE-2021-22928
CVE-2021-22928 is a high-severity vulnerability in Citrix Virtual Apps And Desktops with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- CVSS v2: 7.2
- EPSS exploit prediction: 0% (16th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Citrix Virtual Apps And Desktops
- Published:
- Last modified:
Description
A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM.
Frequently asked questions
- What is CVE-2021-22928?
- A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM.
- How severe is CVE-2021-22928?
- CVE-2021-22928 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2021-22928 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-22928?
- CVE-2021-22928 primarily affects Citrix Virtual Apps And Desktops. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2021-22928?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2021-22928 published?
- CVE-2021-22928 was published on 2021-08-05 and last updated on 2026-06-17.
References
Affected products (9)
- cpe:2.3:a:citrix:virtual_apps_and_desktops:*:*:*:*:-:*:*:*
- cpe:2.3:a:citrix:virtual_apps_and_desktops:1912:-:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:virtual_apps_and_desktops:1912:cu3:*:*:*:*:*:*
- cpe:2.3:a:citrix:xenapp:7.15:-:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:xenapp:7.15:cu6:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:xenapp:7.15:cu7:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:xendesktop:7.15:-:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:xendesktop:7.15:cu6:*:*:ltsr:*:*:*
- cpe:2.3:a:citrix:xendesktop:7.15:cu7:*:*:ltsr:*:*:*
More vulnerabilities in Citrix Virtual Apps And Desktops
- CVE-2020-8283 — High (CVSS 8.8): An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as…
- CVE-2020-8270 — High (CVSS 8.8): An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD…
- CVE-2020-8269 — High (CVSS 8.8): An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009,…
- CVE-2025-6759 — High (CVSS 7.8): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Windows Virtual Delivery Agent…
- CVE-2024-6151 — High (CVSS 7.8): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for…
- CVE-2023-24483 — High (CVSS 7.8): A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to…