Back to live map

CVE-2024-8068

KEVCitrix Session Recording Improper Privilege Management Vulnerability

Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

CVSS 4.0 vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PublishedNov 12, 2024
Last modifiedJun 17, 2026
Added to KEVAug 25, 2025
Remediation dueSep 15, 2025
    56
    Risk assessment · Medium

    Actively exploited. Patch immediately.

    Exploitation
    Confirmed in the wild (CISA KEV)
    Federal remediation deadline
    Overdue by 407 days
    CVSS
    5.1 MEDIUM
    EPSS (30-day exploit probability)
    3.5% · top 11% of all CVEs
    Weakness
    CWE-269
    1. 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    2. 2.Treat as emergency change: patch or isolate internet-facing instances first.
    3. 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

    Assessment is derived automatically from the live signals above; verify against your own asset inventory.