Citrix XenDesktop Virtual Desktop Agent (VDA) 5.6.x before 5.6.200, when making changes to the server-side policy that control USB redirection, does not propagate changes to the VDA, which allows authenticated users to retain access to the USB device.
https://exchange.xforce.ibmcloud.com/vulnerabilities/80626
http://www.securitytracker.com/id?1027869
http://www.securityfocus.com/bid/56908
http://support.citrix.com/article/CTX135813