CVE-2024-8069

Citrix Session Recording

Published 12 Nov 2024 · updated 17 Jun 2026 · Analyzed

5.1 Medium · CVSS 4.0, citrix.com

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Aug 2025, with a remediation deadline of 15 Sept 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server

References

support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8069 · US Government Resource