CVE-2026-118268 is a local privilege escalation vulnerability in the Citrix Secure Access Client for Windows. Citrix says a standard local user can escalate to SYSTEM. The vulnerability is classified as CWE-269, improper privilege management, and has a CVSS 4.0 base score of 8.5.
The vendor published the bulletin on November 12, 2026. Affected versions are Citrix Secure Access Client for Windows releases before 26.11.1.6. The fixed release is 26.11.1.6 or later.
The threat model
An attacker needs local access as a standard user. That access can come from a compromised help-desk account, a malicious application running in a user session, or a stolen remote-support session. Once the attacker reaches SYSTEM, endpoint controls that depend on local administrator separation become less useful.
This is not a remote code execution flaw by itself. It is a trust-boundary failure on endpoints that often hold VPN configuration, certificates, saved connection profiles, and browser sessions. The client may also be installed on shared workstations and jump hosts, where a standard user can interact with it without holding administrator rights.
Inventory beyond a software title
A software inventory query that only looks for the product name may miss the version. Citrix administrators should collect the installed MSI product code, file version, install path, and service state. Compare the result with 26.11.1.6. Include golden images, VDI templates, remote-support appliances, and laptops that are not currently connected to the corporate network.
Endpoint management can report the application, but the data is only useful if the version field maps to the vendor's numbering. Validate a sample on each operating-system build before declaring the estate clean.
Upgrade planning
Package the fixed release and test the upgrade path with the existing VPN profile. A clean installation is not the only case. The update must preserve certificates, machine identity, user preferences, and the service configuration used by the organization.
For shared systems, perform the upgrade under a controlled maintenance process and confirm that the old service is removed. If the update requires a reboot, sequence it before users reconnect to sensitive resources. Do not leave a mixed fleet in which a remote user can launch the older client from a secondary path.
Detection and containment
Review endpoint telemetry for unusual process creation from the client's install directory, attempts to modify services or protected directories, and privilege changes immediately after client startup. Correlate local account activity with remote-access sessions and help-desk tickets.
If compromise is suspected, isolate the endpoint, preserve memory and relevant logs, and rotate credentials and certificates that the endpoint could access. A local administrator account that was elevated through the client may have changed logs or installed persistence before the device was isolated.
Practical conclusion
The fix belongs in endpoint patch management, but the control decision belongs to security operations. Identify which users can reach the client, whether shared hosts expose it to many accounts, and which credentials are present in those sessions. The patch removes the known privilege path. The inventory and session review reduce the chance that an already elevated endpoint remains unnoticed.