Citrix published bulletin CTX697034 for Citrix Workspace app for Windows, CVE-2026-78546 and CVE-2026-78547. The fix is in 2507.1 LTSR CU3, there is no workaround, so the only remediation is the version upgrade. One comment: the fixed build was publicly available before the bulletin, and that is not how this should work. If the intent was to give companies time to deploy, the effect is the opposite, because without a clear security flag a new release goes into the normal long test cycle at low priority. Meanwhile anyone who diffs CU2 against CU3 already has the changes mapped out, so the window works for the attacker and not for the defender. @Darius Shafie

Hi @Arthur thanks for the feedback, let me discuss this internally with our team.

Thanks as always, and I really appreciate your support.