CVE-2024-8068: medium-severity vulnerability in Citrix Session Recording
Privilege escalation to NetworkService Account access
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
An authenticated user in the same Windows Active Directory domain can escalate their privileges to gain NetworkService Account access in Citrix Session Recording. This allows them to perform actions with higher permissions than their account normally allows.
CWE-269 (Improper Access Control) vulnerability enabling privilege escalation to NetworkService Account in Citrix Session Recording. Attack vector requires authentication within the same AD domain as the recording server; successful exploitation grants elevated permissions equivalent to the NetworkService system account, potentially allowing unauthorized access to recorded session data and system resources.
The full analysis of this CVE is available in Portuguese →