{"id":"CVE-2019-11634","kind":"vulnerability","aliases":["CVE-2019-11634"],"related":[],"title":"Citrix Workspace Application and Receiver for Windows: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","description":"Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Citrix Workspace Application and Receiver for Windows fail to enforce local drive access preferences, which allows remote code execution on the client. An attacker who can reach a user's session can run code on that Windows machine.","severity":"critical","cvss":9.8,"epss":0.08091,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Citrix Workspace Application and Receiver for Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix","citrix-workspace","exploited","ransomware","vendor","virtual-desktops","windows"],"not_affected_if":["no-citrix-clients"],"how_to_check":"Check the installed Citrix Workspace app or Receiver version under Programs and Features on each Windows client.","fix":"Update Citrix Workspace app or Receiver for Windows to the version fixed by Citrix, as CISA requires applying the vendor updates.","status":"open","published_at":"2019-05-22T17:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:42+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-23T21:33:42Z","model":"claude-haiku-5-5","output":{"fix":"Update Citrix Workspace app or Receiver for Windows to the version fixed by Citrix, as CISA requires applying the vendor updates.\nunknown","reach":"unknown","impact":"high","summary":"Citrix Workspace Application and Receiver for Windows fail to enforce local drive access preferences, which allows remote code execution on the client. An attacker who can reach a user's session can run code on that Windows machine.","category":"vendor","who_cares":["citrix","windows","citrix-workspace","virtual-desktops"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote code runs on the Windows client machine","analyst_note":"Find the fixed version numbers and attack preconditions in the Citrix security bulletin for CVE-2019-11634, since the sources give neither.","how_to_check":"Check the installed Citrix Workspace app or Receiver version under Programs and Features on each Windows client.\nunknown","needs_analyst":true,"not_affected_if":["no-citrix-clients"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000484,"input_tokens":2872,"output_tokens":394,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-11634':21A,24A '-2019':20A,23A 'access':55B,97C 'action':109C 'allow':58B 'and':28A 'appli':110C 'applic':3A,10A,45B,83C 'application':27A 'attack':66B 'cisa':107C 'citrix':1A,8A,25A,32B,34B,43B,81C 'citrix-workspac':33B 'client':64B,104C 'code':16A,60B,76B,90C 'contain':88C 'cve':19A,22A 'desktop':41B 'drive':54B,96C,106C 'enforc':52B,101C 'execut':17A,61B,91C 'exploit':36B 'fail':50B 'for':30A 'instruct':114C 'local':53B,95C,105C 'machin':80B 'per':112C 'prefer':56B,98C 'ransomwar':37B 'reach':69B 'receiv':5A,12A,47B,85C 'receiver':29A 'remot':15A,59B,89C 'requir':108C 'result':93C 'run':75B 'session':73B 'updat':111C 'user':71B 'vendor':38B,113C 'virtual':40B 'virtual-desktop':39B 'vulner':18A,92C 'window':7A,14A,42B,49B,79B,87C 'windows':31A 'workspac':2A,9A,35B,44B,82C 'workspace':26A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-05-22T17:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-11634","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11634","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:44+00:00","note":null},{"source":"epss","external_id":"CVE-2019-11634","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11634","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-11634","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11634","severity":null,"published_at":"2019-05-22T17:29:00+00:00","modified_at":"2026-08-12T05:17:21+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}