Actively exploited in the wild
Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
Citrix - Workspace Application and Receiver for Windows · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-11634
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
Citrix Workspace App before 1904 for Windows has an incorrect access control vulnerability, potentially allowing unauthorized access to resources.
Risk Assessment
Incorrect access control could allow users to access data or functions they are not authorized for, leading to confidentiality and integrity breaches.
Recommendation
Update Citrix Workspace App to version 1904 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Citrix Workspace App
See all- CVE-2026-84420Medium
An out-of-bounds read vulnerability in Citrix Workspace app for Windows. This issue affects versions before 2603.20 CR, before LTSR 2607, and before LTSR 2507 CU3.
- CVE-2026-84419Medium
An out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects versions before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1.
- CVE-2026-18751Medium
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607.
Original NVD description (English source)
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS