Is CVE-2026-84420 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84420 being exploited in the wild.

How severe is CVE-2026-84420?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Citrix Workspace app for Windows before 2603.20 CR, before LTSR 2607, before LTSR 2507 CU3.

Is there a fix for CVE-2026-84420?

Yes: fixed in 2603.20 CR, LTSR 2607, LTSR 2507 CU3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-84420?

Check whether you run Citrix Workspace app for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84420: Citrix Workspace app for Windows out-of-bounds read

CVE-2026-84420 · Severity: info · Published 2026-10-13

Citrix Workspace app for Windows, used by enterprises to access remote applications and desktops, contains an out-of-bounds read vulnerability that could allow an attacker to read sensitive memory content. While the advisory reports this as information severity with no known active exploitation, it could potentially lead to information disclosure affecting user sessions or system data.

Vendors: Citrix.

Quick answers

Is CVE-2026-84420 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84420 being exploited in the wild.
How severe is CVE-2026-84420?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Citrix Workspace app for Windows before 2603.20 CR, before LTSR 2607, before LTSR 2507 CU3.
Is there a fix for CVE-2026-84420?: Yes: fixed in 2603.20 CR, LTSR 2607, LTSR 2507 CU3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84420 attacked?: It is in a web application.
Am I affected by CVE-2026-84420?: Check whether you run Citrix Workspace app for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2603.20 CR, LTSR 2607, LTSR 2507 CU3

Technical details

An out-of-bounds read vulnerability exists in Citrix Workspace app for Windows, likely triggered by improper bounds checking when processing memory or data structures. The vulnerability may require user interaction or be reachable through network means; exploitation results in unauthorized memory access that could expose sensitive information. Patches are available in versions 2603.20 CR and later, LTSR 2607, and LTSR 2507 CU3.

Affected products

Citrix Workspace app for Windows before 2603.20 CR, before LTSR 2607, before LTSR 2507 CU3

Timeline

2026-10-13: disclosed

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697181

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.