CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git

CVE-2024-8069 is a deserialization of untrusted data flaw (CWE-502) in Citrix Session Recording that permits limited remote code execution running with Network Service account privileges. It is triggered when an authenticated user on the same intranet as the Session Recording server sends maliciously crafted serialized data to the server, so it does not require internet exposure or unauthenticated access. A successful attacker gains code execution on the Session Recording server with Network Service–level privileges, a limited but useful foothold for lateral movement. Only organizations that have deployed the Session Recording component of Citrix Virtual Apps and Desktops are affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-08-25, confirming exploitation in the wild, and EPSS estimates a 14.6% chance of exploitation in the next 30 days (96th percentile).

Do: Upgrade Citrix Session Recording to the patched releases listed in Citrix's security bulletin, and first confirm whether the optional Session Recording component is actually installed in your Virtual Apps and Desktops environment, since many deployments omit it. Restrict network access to Session Recording servers to trusted, authenticated intranet users, and apply CISA BOD 22-01 remediation deadlines if you are a federal agency.

CVE-2025-48384 is a high-severity (CVSS 8.0) link-following/path-interpretation flaw (CWE-59, CWE-436) in Git's config handling: trailing carriage returns are written unquoted into config files and stripped when the value is later read, so a submodule path containing a trailing CR resolves to a different location during submodule initialization. If an attacker crafts a repository whose submodule path ends in a CR and a symlink maps the altered path to the submodule's hooks directory, an executable post-checkout hook inside the submodule is unintentionally run after checkout, yielding arbitrary code execution on the machine running Git (network vector, user interaction required, scope changed, high C/I/A impact). Any user or CI/CD system running an affected Git release when cloning an untrusted repository with maliciously crafted submodule configuration is exposed; CISA lists Git as the affected product, with CPEs also covering Git as packaged by Debian and bundled with Apple's Xcode. The flaw is being exploited in the wild: CISA added it to the KEV catalog on 2025-08-25, news outlets report active exploitation leading to RCE, EPSS is 4.1% (90th percentile), ransomware association is unknown, and no public proof-of-concept is known.

Do: Upgrade Git immediately to 2.50.1 or to the fixed release matching your maintenance line (2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, or 2.49.1); on Debian apply the distribution security update and on macOS update Xcode/Command Line Tools via Apple's security update. As an interim check, inspect .gitmodules and repo configuration for submodule paths containing trailing carriage-return characters before initializing submodules from untrusted repositories. Federal agencies must patch per the KEV listing (added 2025-08-25) and BOD 22-01 guidance.