Actively exploited · Published Nov 12, 2024 · Assigned by Citrix
CVE-2024-8069Limited remote code execution with privilege of a NetworkService Account access
Medium 5.1 Exploited
In plain English
A medium-severity unsafe deserialization in Citrix Session Recording from Citrix Session Recording. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2025). The chance it is exploited in the next 30 days is estimated at 18.2% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Sep 15, 2025.
Official description
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Citrix Session Recording | Citrix Session Recording | 2407 Current Release – before 24.5.200.81912 LTSR – before CU9 hotfix 19.12.9100.62203 LTSR – before CU5 hotfix 22.03.5100.112402 LTSR – before CU1 hotfix 24.02.1200.16 |
Weakness: CWE-502 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N