When the identity provider removes someone from a group, check that their shared workspaces actually disappear. Citrix fixed a SecurSpaces issue that could leave that access in place after SCIM group changes.
What Citrix fixed
Citrix’s release notes date SecurSpaces 2026.9.7 to November 11, 2026. The notes were updated November 12. Removing a member or deleting a group via SCIM could leave shared workspace access in place. In the fixed release, access is removed when the user has no remaining project membership. The same release routes invalid workspace resume destinations back to the console.
Check SecurSpaces deployments that use SCIM group provisioning and shared workspaces. Citrix’s release note names 2026.9.7 as fixed. It gives no exact affected-version range, CVE, severity, CVSS score, exploitation assessment, separate workaround, or credential-rotation requirement. CISA KEV has no matching entry as of November 12.
Suggested MSP priority · expedite where offboarding depends on SCIM
Inventory SecurSpaces deployments, their platform versions, and the identity provider groups used to provision access. Review recent group removals and deletions against effective shared workspace access. Revoke unexpected access and review relevant audit records where you find a mismatch.
For self-managed deployments, back up the configuration database and follow Citrix’s supported installer and Helm upgrade procedure to deploy 2026.9.7 or a later supported release that includes the fix. For managed deployments, confirm the running version and rollout with the provider. After updating, confirm healthy pods and use a test account to verify that removing its final project membership removes shared workspace access.
Last verified November 12, 2026. Citrix 2026.9.7 release notes · Citrix upgrade guide · Citrix SCIM configuration · CISA KEV data