Citrix Workspace — known CVE vulnerabilities

Every CVE whose affected-product data names Citrix Workspace, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (14)

• CVE-2019-11634 — CVSS 9.8 (critical) — actively exploited: Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
• CVE-2020-8207 — CVSS 8.8 (high): Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the…
• CVE-2024-6148 — CVSS 8.8 (high): Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5
• CVE-2023-24485 — CVSS 7.8 (high): Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer…
• CVE-2025-4879 — CVSS 7.8 (high): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
• CVE-2021-22907 — CVSS 7.8 (high): An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions…
• CVE-2022-21825 — CVSS 7.8 (high): An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow…
• CVE-2024-6286 — CVSS 7.8 (high): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
• CVE-2024-7889 — CVSS 7.3 (high): Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
• CVE-2024-7890 — CVSS 7.3 (high): Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
• CVE-2024-6149 — CVSS 6.1 (medium): Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5
• CVE-2024-42423 — CVSS 6.1 (medium): Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled…
• CVE-2023-24486 — CVSS 5.5 (medium): A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able…
• CVE-2023-24484 — CVSS 5.5 (medium): A malicious user can cause log files to be written to a directory that they do not have permission to write to.