CVE-2025-66391: Citrix Cloud Read-Only Account Privilege Escalation to Account Takeover

Technical summary

CVE-2025-66391 stems from an improper access control weakness (CWE-284) in Citrix Cloud's workflow authorization layer. The vulnerability allows principals with read-only credentials to invoke write-level operations by triggering the initiation of administrative workflows. The attacker gains the ability to request one-time passwords for password reset operations, with delivery sent to an email address under the attacker's control. This occurs because the system validates read-only roles at the API level but fails to enforce equivalent restrictions on workflow state transitions, creating a logical bypass where read permissions inadvertently enable write actions.

Business impact

This vulnerability enables account takeover of any user within a compromised Citrix Cloud tenant. An insider with minimal read-only access—such as a support agent, junior analyst, or contractor—can reset credentials for privileged accounts without detection. This directly threatens confidentiality, integrity, and availability of cloud-hosted workloads and administrative functions. Organizations may face unauthorized access to sensitive data, lateral movement into connected infrastructure, compliance violations, and loss of audit trail integrity if attackers modify accounts after takeover.

Affected systems

Citrix Cloud environments are affected through the version released on 2025-11-10 and earlier. The specific affected version range requires verification against Citrix's official advisory and patch history. Any Citrix Cloud tenant where users possess read-only roles is potentially vulnerable to this privilege escalation. Environments with service accounts, delegated administration roles, or third-party integrations using read-only credentials face elevated risk.

Exploitability

This vulnerability has a CVSS 3.1 score of 8.8 (HIGH severity) due to its network accessibility, low attack complexity, and requirement for valid (albeit low-privileged) credentials. The attack requires authentication but no user interaction, making it straightforward to automate and scale. The primary limiting factor is that an attacker must already possess valid read-only account credentials—either through insider threat, compromised credentials, or legitimate employment. Once credentials are in hand, exploitation is trivial and leaves minimal forensic evidence if the attacker uses legitimate workflow APIs.

Remediation

Citrix has released patches addressing the access control weakness. Organizations should verify the patched version number against Citrix's official advisory and deploy updates to all affected Citrix Cloud environments immediately. Patch deployment should be prioritized given the account takeover risk. Concurrently, implement compensating controls: enforce multi-factor authentication on all account password resets, implement email notification confirmations for password reset OTPs, audit and restrict read-only role assignments to minimum-necessary principals, and enable detailed logging of workflow initiations.

Patch guidance

Contact Citrix support or consult the official security advisory to obtain the specific patched version that addresses CVE-2025-66391. Verify the advisory against the publication date of 2026-06-17 to ensure you have the current guidance. Apply patches through Citrix Cloud's update mechanism, which typically does not require downtime for SaaS-hosted environments. Test the patch in a non-production tenant first if possible. After patching, confirm that read-only roles no longer trigger password reset workflows through manual testing or automated security validation.

Detection guidance

Monitor Citrix Cloud audit logs for workflow initiations originating from read-only role accounts, particularly password reset requests or credential modification operations. Alert on any OTP generation events correlated with IP addresses or user agents inconsistent with the account's normal behavior. Search historical logs for anomalous patterns where low-privileged accounts triggered high-impact administrative workflows. Implement real-time alerting if your SIEM integrates with Citrix Cloud audit streams. Review CloudTrail or equivalent logs if Citrix Cloud is integrated with AWS or other cloud providers for downstream evidence of account compromise.

Why prioritize this

This vulnerability merits immediate patching despite not yet being on the KEV catalog. The combination of high CVSS score (8.8), requirement for only read-only credentials (widely distributed), and direct path to account takeover create urgent risk. Any organization with Citrix Cloud and granular role-based access controls that delegate read-only access to multiple users should treat this as critical. The fact that exploitation is trivial, leaves minimal forensic artifacts, and affects identity infrastructure makes this a top candidate for targeted attacks by insiders or compromised-credential scenarios.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects network-based attack vector, low attack complexity, low privilege requirements, and high impact across confidentiality, integrity, and availability. The score appropriately captures that a legitimate but unprivileged user can fully compromise account security of higher-privileged users. Business risk is elevated further by the identity-infrastructure nature of the vulnerability—account takeover is a precursor to broader compromise and is difficult to contain once exploitation begins.

Frequently asked questions