CVE-2024-8068 Citrix Session Recording Improper Privilege Management
Authenticated users in the same Active Directory domain can escalate privileges to NetworkService Account access on Citrix Session Recording servers.
- Exploited in the wild
- Since 25 Aug 2025
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8068?
CVE-2024-8068 is a medium-severity vulnerability in Citrix Session Recording, published on 12 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
Weakness: CWE-269
Which versions are affected by CVE-2024-8068?
It affects 1 product.
Products include Citrix Session Recording.
How do I fix CVE-2024-8068?
No fix has been published for CVE-2024-8068 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Sep 2025.
Is CVE-2024-8068 being exploited?
Yes. Attackers have exploited CVE-2024-8068 in the wild since at least 25 Aug 2025.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Citrix Session Recording
Sources
Also known as GHSA-c43q-qj38-7p5j.