Security readout for executives and security teams
Plain-English summary
CVE-2019-11634 is a critical access-control flaw in Citrix Workspace App for Windows versions before 1904. Successful exploitation can compromise confidentiality, integrity, and availability without authentication or user interaction. Because CISA lists it as known exploited, organizations should treat any remaining affected installation as an urgent exposure.
Executive priority
Immediate. Assign ownership, establish the number of affected Windows endpoints, and accelerate remediation. The combination of a 9.8 CVSS score, unauthenticated network attack characteristics, and CISA KEV status makes unresolved installations unacceptable except under documented temporary controls.
Technical view
The supplied CVSS 3.1 score is 9.8: network-accessible, low complexity, no privileges, and no user interaction, with high impact across confidentiality, integrity, and availability. The weakness is categorized as CWE-284, Incorrect Access Control. The bundle does not describe the vulnerable component, attack mechanics, or prerequisites beyond the CVSS vector.
Likely exposure
Exposure is limited to Citrix Workspace App for Windows releases before 1904, according to the supplied description. Prioritize managed endpoints, virtual-desktop users, persistent workstations, and overlooked legacy systems. The bundle provides no evidence about other platforms or products and no reliable estimate of deployment prevalence.
Exploitation context
CISA KEV inclusion supports exploitation in the wild. The supplied sources do not establish campaign timing, affected organizations, exploit availability, attacker identity, or whether exploitation remains widespread. Do not interpret the absence of those details as evidence of low risk.
Researcher notes
The record provides strong severity and exploitation signals but sparse technical detail. The affected-product array is uninformative, while the description specifically identifies Citrix Workspace App for Windows before 1904. Validate exact build applicability and remediation requirements against Citrix CTX251986. No exploit mechanics should be inferred from the CVSS vector alone.
Mitigation direction
- Identify and prioritize Windows endpoints running Citrix Workspace App versions before 1904.
- Upgrade affected installations to a current supported release following Citrix guidance.
- Remove obsolete installations where the application is no longer required.
- Apply compensating network restrictions if upgrades cannot be completed promptly.
- Review current Citrix guidance for any additional remediation or configuration requirements.
Validation and detection
- Inventory installed Citrix Workspace App versions across all managed Windows endpoints.
- Confirm no discovered installation reports a version earlier than 1904.
- Check unmanaged, dormant, and virtual desktop endpoints that may escape routine inventory.
- Verify upgrades completed successfully and endpoints remain on supported releases.
- Review available security telemetry for suspicious activity associated with affected systems.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-11634 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2019-11634 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2021-11-03T00:00:00.000Z: CVE-2019-11634 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://support.citrix.com/v1/search?searchQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+BulletinCVE reference, mitre · x_refsource_MISC
- https://support.citrix.com/article/CTX251986CVE reference, mitre · x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11634CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.