Actively exploited · Published Nov 12, 2024 · Assigned by Citrix
CVE-2024-8068Privilege escalation to NetworkService Account access
Medium 5.1 Exploited
In plain English
A medium-severity privilege mismanagement in Citrix Session Recording from Citrix. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2025). The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Sep 15, 2025.
Official description
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Citrix | Citrix Session Recording | 2407 Current Release – before 24.5.200.81912 LTSR – before CU9 hotfix 19.12.9100.62203 LTSR – before CU5 hotfix 22.03.5100.112402 LTSR – before CU1 hotfix 24.02.1200.16 |
Weakness: CWE-269 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N