CVE-2024-8069

CVE-2024-8069 is a deserialization of untrusted data flaw (CWE-502) in Citrix Session Recording that permits limited remote code execution running with Network Service account privileges. It is triggered when an authenticated user on the same intranet as the Session Recording server sends maliciously crafted serialized data to the server, so it does not require internet exposure or unauthenticated access. A successful attacker gains code execution on the Session Recording server with Network Service–level privileges, a limited but useful foothold for lateral movement. Only organizations that have deployed the Session Recording component of Citrix Virtual Apps and Desktops are affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-08-25, confirming exploitation in the wild, and EPSS estimates a 14.6% chance of exploitation in the next 30 days (96th percentile).

What to do: Upgrade Citrix Session Recording to the patched releases listed in Citrix's security bulletin, and first confirm whether the optional Session Recording component is actually installed in your Virtual Apps and Desktops environment, since many deployments omit it. Restrict network access to Session Recording servers to trusted, authenticated intranet users, and apply CISA BOD 22-01 remediation deadlines if you are a federal agency.