Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406
Description of Problem
Vulnerabilities have been discovered in the Citrix Workspace app for Windows. Refer to the information below for further details.
Affected Versions
The following supported versions of the Citrix Workspace app for Windows are impacted by CVE-2026-84419:
Current Release (CR):
- Citrix Workspace app for Windows versions BEFORE 2603.20
Long Term Service Release (LTSR):
- Citrix Workspace app for Windows versions BEFORE LTSR 2607 Hotfix 1
- Citrix Workspace app for Windows versions BEFORE LTSR 2507 CU3 Hotfix 1
The following supported versions of the Citrix Workspace app for Windows are impacted by CVE-2026-84420:
Current Release (CR):
- Citrix Workspace app for Windows versions BEFORE 2603.20
Long Term Service Release (LTSR):
- Citrix Workspace app for Windows versions BEFORE LTSR 2607
- Citrix Workspace app for Windows versions BEFORE LTSR 2507 CU3
Details
NetScaler ADC and NetScaler Gateway is affected by the vulnerability described below:
| CVE-ID | Description | Pre-conditions | CWE | CVSSv4 |
| VE-2026-84419 | Out-of-Bounds Write | Local access to the target system AND App Protection feature enabled | CWE-787: Out-of-bounds Write | CVSS v4.0 Base Score: 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CVE-2026-84420 | Out-of-Bounds Write and Out-of-Bounds Read | Local access to the target system | CWE-787: Out-of-bounds Write CWE-125: Out-of-bounds Read | CVSS v4.0 Base Score: 5.8CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N |
Recommended Action
Citrix strongly recommends that customers upgrade their Citrix Workspace app for Windows to versions that contain the fixes as soon as possible.
CVE-2026-84419 – Citrix Workspace app for Windows versions that contain the fixes for CVE-2026-84419 are:
Current Release (CR)
- Citrix Workspace app for Windows 2603.20 and later versions
Long Term Service Release (LTSR)
- Citrix Workspace app for Windows LTSR 2607 Hotfix 1 and later versions
- Citrix Workspace app for Windows LTSR 2507 CU3 Hotfix 1 and later versions
CVE-2026-84420 – Citrix Workspace app for Windows versions that contain the fixes for CVE-2026-84420 are:
Current Release (CR)
- Citrix Workspace app for Windows 2603.20 and later versions
Long Term Service Release (LTSR)
- Citrix Workspace app for Windows LTSR 2607 and later versions
- Citrix Workspace app for Windows LTSR 2507 CU3 and later versions