PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9678 Citrix CVE debrief

CVE-2016-9678 is a critical use-after-free vulnerability in Citrix Provisioning Services. NVD lists affected releases from 7.0 through 7.11, with remediation implied by the vendor guidance and the product fix threshold of 7.12. The published record describes potential arbitrary code execution, and the CVSS 3.0 vector indicates a network-reachable issue with no privileges or user interaction required.

Vendor
Citrix
Product
CVE-2016-9678
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Administrators and security teams running Citrix Provisioning Services 7.0, 7.1, 7.6, 7.7, 7.8, 7.9, or 7.11 should prioritize this issue, especially where the service is reachable on enterprise networks. Incident responders should also care because the severity and attack characteristics make it suitable for high-impact exploitation if exposed.

Technical summary

NVD classifies the weakness as CWE-416 (use-after-free). The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates a network-attackable flaw requiring no prior privileges or user interaction and with high confidentiality, integrity, and availability impact. The NVD record ties the issue to Citrix Provisioning Services versions 7.0, 7.1, 7.6, 7.7, 7.8, 7.9, and 7.11, with Citrix’s advisory referenced as the vendor source.

Defensive priority

High. This is a critical, remotely reachable memory-safety vulnerability with full CIA impact in the CVSS record, so affected deployments should be treated as urgent patch candidates.

Recommended defensive actions

  • Upgrade Citrix Provisioning Services to a fixed release at or above 7.12.
  • Identify any installations running the vulnerable versions listed by NVD: 7.0, 7.1, 7.6, 7.7, 7.8, 7.9, and 7.11.
  • Review Citrix’s vendor advisory for product-specific remediation guidance and confirm whether any compensating controls are documented.
  • Prioritize internet-facing or broadly reachable management/service endpoints first.
  • Validate remediation in an asset inventory and track completion by version, not just by product name.

Evidence notes

All substantive claims are taken from the supplied NVD record and cited references. The record was published on 2017-01-18 and later modified on 2026-05-13; that modified date reflects record maintenance, not the vulnerability issue date. The supplied corpus identifies the weakness as CWE-416, provides the CVSS 3.0 vector, and lists Citrix Provisioning Services vulnerable versions plus the vendor advisory reference.

Official resources

Publicly disclosed in the CVE/NVD record on 2017-01-18. The NVD entry was later modified on 2026-05-13, but that does not change the original disclosure timing.