Citrix Session Recording vulnerabilities

2 CVEs affecting Citrix Session Recording, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-8069, published 2024-11-12.

More from Citrix.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-8069: Citrix Session Recording Deserialization of Untrusted Data Vulnerability, published 2024-11-12. High severity, CVSS 8.0. Actively exploited: in CISA KEV since 2025-08-25. EPSS: 14.6% chance of exploitation in the next 30 days. Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording…
• CVE-2024-8068: Citrix Session Recording Improper Privilege Management Vulnerability, published 2024-11-12. High severity, CVSS 8.0. Actively exploited: in CISA KEV since 2025-08-25. EPSS: 3.5% chance of exploitation in the next 30 days. Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server…