VulnerabilityAnalyzed

CVE-2024-8068

Citrix Session Recording Improper Privilege Management Vulnerability

KEVMEDIUM 5.1EPSS 3.48%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 September 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 3.48% probability · 89th percentile
Public exploits: None in Exploit-DB
CISA KEV: Listed 25 August 2025 · due 15 September 2025
Weakness: CWE-269
Affected: citrix/session recording
Source: secure@citrix.com

EPSS trend

EPSS moved from 3.5% on 24 September 2026 to 3.5% on 26 October 2026.

CISA notes

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.citrix.com/external/article/691941/citrix-session-recording-security-bullet.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-8068

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.