CVE-2020-8283: 
Citrix Virtual Delivery Agent (VDA) vulnerability analysis and mitigation

An authenticated user vulnerability was discovered in Citrix Virtual Apps and Desktops (CVAD) affecting the Universal Print Server (UPS) component on Windows hosts. The vulnerability, identified as CVE-2020-8283, was disclosed on January 28, 2020, and affects multiple versions of CVAD including versions before 2009, 1912 LTSR CU1, 7.15 LTSR CU6, and 7.6 LTSR CU9 (CVE Details, Citrix Support).

The vulnerability allows an authenticated user on a Windows host running Citrix Universal Print Server to perform arbitrary command execution with SYSTEM privileges. This affects specific versions of CVAD including those prior to version 2009, 1912 LTSR CU1 (before hotfixes CTX285870 and CTX286120), 7.15 LTSR CU6 (before hotfix CTX285344), and 7.6 LTSR CU9 (CVE Details).

The vulnerability allows authenticated users to execute arbitrary commands with SYSTEM-level privileges on affected Windows systems running the Universal Print Server component. This represents a significant elevation of privilege that could lead to complete system compromise (Citrix Support).

Citrix has released several hotfixes to address this vulnerability: CTX285870 and CTX286120 for version 1912 LTSR CU1, CTX285344 for version 7.15 LTSR CU6, and updates for version 7.6 LTSR CU9. Organizations are advised to apply these security updates to affected systems (Citrix Support).