If you manage Citrix VPN clients, verify the version on each endpoint. The Windows and Linux fixes have different release numbers.
What Citrix disclosed
Citrix published both advisories on November 12, 2026. Each flaw requires local access as a standard user and is rated High, CVSS 4.0 8.5 by Citrix.
Windows · CVE-2026-118268 / CTX697280. Supported Citrix Secure Access client releases before 26.11.1.6 allow a local low-privilege user to escalate to SYSTEM. Install 26.11.1.6 or later. Citrix lists separate x86, x64 and Arm64 MSI packages.
Linux · CVE-2026-118269 / CTX697281. Supported client releases before 26.10.4 allow a local low-privilege user to escalate to root. Install 26.10.4 or later. Citrix’s Linux documentation uses both Secure Access and SecurAccess naming.
Suggested MSP priority
Prioritize shared devices and endpoints used for privileged work. Inventory versions and architectures with endpoint management, including Intune where used. Verify the packages you deploy, pilot VPN sign-in and connectivity, then roll out by OS. Check installed versions and reconnect from a test device after deployment. If endpoint telemetry indicates compromise, contain and investigate through your normal incident-response process.
Verified November 13, 2026 UTC. The Citrix bulletins provide no exploitation assessment, workaround, compromise-check or credential-rotation directive. CISA KEV did not list either CVE at verification.
Citrix Windows bulletin CTX697280 · Citrix Linux bulletin CTX697281 · Citrix Windows downloads and checksums · Citrix Linux client documentation · CISA’s official KEV data