If a customer uses Citrix App Layering to build virtual desktop images, check who can reach the appliance that publishes them.
What Citrix disclosed
On November 12, 2026, Citrix published CTX697319 / CVE-2026-122990. A remote attacker who can reach the App Layering management interface can bypass authentication and reach restricted resources. Citrix rates the flaw Critical, CVSS 4.0 9.3.
Affected builds and fix
Supported Citrix App Layering releases before 2603.9 are affected. Upgrade the Enterprise Layer Manager (ELM) appliance to 2603.9 or later. Citrix’s upgrade guide calls for a backup and a configured network file share. Appliances on 2403 or earlier require the documented migration to a newer appliance. The bulletin lists no workaround, compromise-check or credential-rotation directive.
Suggested MSP priority
Expedite appliances reachable from the internet or untrusted networks. Inventory ELM builds and management reachability across customer environments. Restrict management access to approved admin networks while you prepare the upgrade. Where exposure or suspicious changes warrant investigation, preserve relevant access and image-publishing records and review layers, templates and recent publishes. After the upgrade, verify the appliance version, admin access boundaries and a test image publish.
Verified November 13, 2026 UTC. The Citrix bulletin gives no exploitation assessment. CISA KEV did not list this CVE at verification.
Citrix bulletin CTX697319 · Citrix upgrade and migration guide · CISA’s official KEV data