What’s Vulnerable › Vulnerabilities

CVE-2024-8069: Limited remote code execution with privilege of a NetworkService Account access

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-08-25
• EPSS: 21.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-12 · updated 2026-06-17
• Weakness: CWE-502

Description

Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server

Affected products

• Citrix Session Recording: before 2407; 1912-cu1, 1912-cu2, 1912-cu3, 1912-cu4, 1912-cu5, 1912-cu6 (+6); 1912, 2203, 2402, 2407 — fixed in 2407
• Citrix Session Recording: from 2407 Current Release before 24.5.200.8; from 1912 LTSR before CU9 hotfix 19.12.9100.6; from 2203 LTSR before CU5 hotfix 22.03.5100.11; from 2402 LTSR before CU1 hotfix 24.02.1200.16 — fixed in 24.5.200.8, CU9 hotfix 19.12.9100.6, CU5 hotfix 22.03.5100.11, CU1 hotfix 24.02.1200.16

How to fix

Upgrade to a fixed version: Citrix Session Recording 2407; Citrix Session Recording 24.5.200.8, CU9 hotfix 19.12.9100.6, CU5 hotfix 22.03.5100.11, CU1 hotfix 24.02.1200.16. Check the vendor advisory for mitigations.

References

• https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8069

Get alerted when CVE-2024-8069 or the next vulnerability affects your stack