VulnerabilityAnalyzed

CVE-2024-8068

Citrix Session Recording Improper Privilege Management Vulnerability

KEVMEDIUM 5.1EPSS 1.40%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 September 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 1.40% probability · 71th percentile
CISA KEV: Listed 25 August 2025 · due 15 September 2025
Weakness: CWE-269
Affected: citrix/session recording
Source: secure@citrix.com

CISA notes

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.citrix.com/external/article/691941/citrix-session-recording-security-bullet.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-8068

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.