High severity · published Nov 12, 2024
CVE-2024-8068
Privilege escalation to NetworkService Account access
In wildKEV
8.0
CVSS
3.5%
EPSS
Yes
On KEV
Description
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildYes
CISA KEVListed Aug 25, 2025
Federal remediation dueSep 15, 2025
Ransomware campaign useNot known
Affected products
Which versions
CS
Citrix Session Recording · Citrix
2407 Current Release before 24.5.200.8; 1912 LTSR before CU9 hotfix 19.12.9100.6; 2203 LTSR before CU5 hotfix 22.03.5100.11; 2402 LTSR before CU1 hotfix 24.02.1200.16 · source: vendor
SR
Session Recording · Citrix
before 2407; 1912; 1912; 1912; 1912; 1912; +12 more · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8068
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.citrix.com
https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US