PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9678 Citrix CVE debrief

CVE-2016-9678 is a critical use-after-free vulnerability in Citrix Provisioning Services. NVD lists affected releases from 7.0 through 7.11, with remediation implied by the vendor guidance and the product fix threshold of 7.12. The published record describes potential arbitrary code execution, and the CVSS 3.0 vector indicates a network-reachable issue with no privileges or user interaction required.

Vendor
Citrix
Product
Provisioning Services
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Administrators and security teams running Citrix Provisioning Services 7.0, 7.1, 7.6, 7.7, 7.8, 7.9, or 7.11 should prioritize this issue, especially where the service is reachable on enterprise networks. Incident responders should also care because the severity and attack characteristics make it suitable for high-impact exploitation if exposed.

Technical summary

NVD classifies the weakness as CWE-416 (use-after-free). The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates a network-attackable flaw requiring no prior privileges or user interaction and with high confidentiality, integrity, and availability impact. The NVD record ties the issue to Citrix Provisioning Services versions 7.0, 7.1, 7.6, 7.7, 7.8, 7.9, and 7.11, with Citrix’s advisory referenced as the vendor source.

Defensive priority

High. This is a critical, remotely reachable memory-safety vulnerability with full CIA impact in the CVSS record, so affected deployments should be treated as urgent patch candidates.

Recommended defensive actions

  • Upgrade Citrix Provisioning Services to a fixed release at or above 7.12.
  • Identify any installations running the vulnerable versions listed by NVD: 7.0, 7.1, 7.6, 7.7, 7.8, 7.9, and 7.11.
  • Review Citrix’s vendor advisory for product-specific remediation guidance and confirm whether any compensating controls are documented.
  • Prioritize internet-facing or broadly reachable management/service endpoints first.
  • Validate remediation in an asset inventory and track completion by version, not just by product name.

Evidence notes

All substantive claims are taken from the supplied NVD record and cited references. The record was published on 2017-01-18 and later modified on 2026-05-13; that modified date reflects record maintenance, not the vulnerability issue date. The supplied corpus identifies the weakness as CWE-416, provides the CVSS 3.0 vector, and lists Citrix Provisioning Services vulnerable versions plus the vendor advisory reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9678 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9678

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9678 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9678

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.