Evil-DB LogoEvil-DB
← All CVEs

CVE-2024-8068

medium · 5.1Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added 2025-08-25Remediation due 2025-09-15

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

5.1
CVSS
1.4%
EPSS (exploit prob.)
71st
EPSS percentile
2024-11-12
Published

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-269

Affected products

VendorProductAffected versions
citrixsession_recording< 2407
citrixsession_recording1912
citrixsession_recording1912
citrixsession_recording1912
citrixsession_recording1912
citrixsession_recording1912
citrixsession_recording1912
citrixsession_recording1912
citrixsession_recording1912
citrixsession_recording1912
citrixsession_recording2203
citrixsession_recording2203
citrixsession_recording2203
citrixsession_recording2203
citrixsession_recording2203
citrixsession_recording2203
citrixsession_recording2402
citrixsession_recording2407

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-8068