CVE-2020-8270: 
Citrix Virtual Delivery Agent (VDA) vulnerability analysis and mitigation

An unprivileged Windows user on the Virtual Delivery Agent (VDA) or an SMB user could perform arbitrary command execution as SYSTEM in Citrix Virtual Apps and Desktops (CVAD). This vulnerability, identified as CVE-2020-8270, affected CVAD versions before 2009, 1912 LTSR CU1, and 7.15 LTSR CU6 (CVE Mitre).

The vulnerability was discovered in Citrix Storefront 7.15 CU3 installations, which was one of several security issues identified in the platform. It was classified as a high-severity vulnerability that could allow unauthorized system access and command execution (Threatpost).

When exploited, this vulnerability allows attackers to execute arbitrary commands with SYSTEM-level privileges, effectively giving them complete control over the affected system. This level of access could potentially be used for lateral movement within networks and unauthorized data access (CVE Mitre).

The vulnerability has been documented as being exploitable by unprivileged Windows users on the VDA or SMB users. In real-world scenarios, this vulnerability was observed being exploited alongside other Citrix vulnerabilities by ransomware groups like Nefilim for network infiltration and data exfiltration (Threatpost).

Citrix has released several hotfixes to address this vulnerability: CTX285871 and CTX285872 for version 1912 LTSR CU1, and CTX285341 and CTX285342 for version 7.15 LTSR CU6. It's worth noting that Citrix XenApp/XenDesktop 7.6 LTSR is not affected by this vulnerability (Citrix Support).