Is CVE-2026-18751 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18751 being exploited in the wild.

How severe is CVE-2026-18751?

Informational severity, with a CVSS score of 5.2, published 18 August 2026.

Which products and versions are affected?

Citrix WorkSpace App before 2607.

Is there a fix for CVE-2026-18751?

A patch was published on 2026-08-18: Version 2607 and later addresses the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18751 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-18751?

Check whether you run Citrix WorkSpace App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18751: Citrix WorkSpace App macOS arbitrary root file modification

CVE-2026-18751 · Severity: info · CVSS 5.2 · Published 2026-08-18

Citrix WorkSpace App for macOS contains a vulnerability that allows a locally authenticated user to modify files with root privileges, potentially gaining full administrative control of the system. An attacker with standard user access could exploit this flaw to modify critical system files, install malware, or take complete control of affected Mac systems.

Vendors: Citrix.

Quick answers

Is CVE-2026-18751 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18751 being exploited in the wild.
How severe is CVE-2026-18751?: Informational severity, with a CVSS score of 5.2, published 18 August 2026.
Which products and versions are affected?: Citrix WorkSpace App before 2607.
Is there a fix for CVE-2026-18751?: A patch was published on 2026-08-18: Version 2607 and later addresses the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18751 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-18751?: Check whether you run Citrix WorkSpace App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an external control of file name or path vulnerability (CWE-73) in Citrix WorkSpace App for Mac that allows arbitrary root file modification. The vulnerability requires an attacker to have local authenticated user access to the device where the application is installed, plus user interaction. Exploitation can result in elevation of privilege from a local authenticated user to root, enabling arbitrary file modification with the highest system privileges. Affected versions are those prior to 2607; Citrix has issued a patch recommending customers update to version 2607 or later.

Affected products

Citrix WorkSpace App before 2607

Timeline

2026-08-18: disclosed
2026-08-18: advisory
2026-08-18: patched: Version 2607 and later addresses the vulnerability

References

https://support.citrix.com/external/article/CTX696911

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.