CVE-2024-8068

CVE-2024-8068 is an improper privilege management flaw (CWE-269) in Citrix Session Recording that allows an attacker to escalate to NetworkService Account privileges on the Session Recording server. It is triggered by an authenticated user in the same Windows Active Directory domain as the Session Recording server, who can reach the service over an adjacent network connection (CVSS 4.0 vector AV:A, PR:L, AC:L). A successful attacker gains service-level privileges as the NetworkService account on the recording server, with low-impact effects on that system that could support further lateral movement within the domain. Only organizations running Citrix Session Recording, typically deployed as an optional component of Citrix Virtual Apps and Desktops or Citrix DaaS environments, are affected; unauthenticated or out-of-domain attackers are excluded. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-08-25, confirming exploitation in the wild (ransomware use unknown); no public proof-of-concept is known and EPSS estimates a 1.4% probability of exploitation in the next 30 days.

What to do: Upgrade Session Recording to the fixed releases listed in Citrix's security bulletin and verify the installed build on all recording servers, since the component is often deployed and forgotten. Enumerate which domain users can reach the Session Recording service and restrict access/segment it from general domain accounts to reduce exposure. Federal agencies must apply vendor mitigations or discontinue use under BOD 22-01 timelines because the flaw is KEV-listed.