CVE-2024-6151 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges. Citrix strongly recommends that customers upgrade their Windows Virtual Delivery Agent to versions that contain the fixes as soon as possible. Windows Virtual Delivery Agent versions that contain the fixes are: • Current Release (CR) • Citrix Virtual Apps and Desktops 2402 and later versions Long Term Service Release (LTSR) • Citrix Virtual Apps and Desktops 1912 LTSR CU9 and later cumulative updates • Citrix Virtual Apps and Desktops 2203 LTSR CU5 and later cumulative updates • Citrix Virtual Apps and Desktops 2402 LTSR https://support.citrix.com/article/CTX678035/windows-virtual-delivery-agent-for-cvad-and-citrix-daas-security-bulletin-cve20246151

if customer is on LTSR 2203 CU3 and their SA date is 2024.03.21, they are not entitled to get the security fix, as CU5 requires an SA date of 2024.05.25 ? they would have to upgrade their licensing? Since it is LTSR, I would think they would be entitled to security fixes? Am I missing something here?

Where do you find required SA dates?

On the download page of each CU or ISO.

ahh right there, thanks

I have had two VDA upgrades (LTSR 2203 CU4 Update 1 -> LTSR 2203 CU5 on Windows 2019) fail and two succeed so far. I even tried uninstalling the old VDA + VDA Cleanup Utility, but with no luck. For the ones that failed, I'm just going straight to LTSR 2402 and that seems to work. I've never had a problem running a VDA version newer than the rest of my infrastructure, but does anyone here have any warnings about doing that? I've been running LTSR 2402 in my test environment for a while and it's been good, but then again, my entire infrastructure in Test is LTSR 2402.

I already got some problems with VDA Cleanup Utility for CU4 installation few months ago ☹️

I've just upgraded my production VDAs to LTSR 2402 in my LTSR 2203 CU4 environment rather than risk having LTSR 2203 CU5 upgrades fail. So far so good.

@Sebastian Parelius You can also find a full list here: https://support.citrix.com/s/article/CTX111618-citrix-product-customer-success-services-eligibility-dates?language=en_US

Its not fair as ANY security or bug related update should be available for free to all existing or former customers (all CU updates). It’s just my opinion 🫣 😉 It’s not applicable for new versions or CR etc.