Skip to content
Log inStart free trial

CVE-2024-8068

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active…

Medium Known exploited
Severity
5.1 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
3.48%
Chance of exploitation in the next 30 days. Higher than 89.11% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Aug 25, 2025
Weakness
CWE-269 Improper Privilege Management
Fix
None yet
No fixed version published
Exploited in the wild. Citrix Session Recording Improper Privilege Management Vulnerability (Citrix Session Recording). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Sep 15, 2025.

Description

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 5.1

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector
Adjacent
Attack complexity
Low
Attack requirements
None
Privileges required
Low
User interaction
None
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
Low
Availability (vulnerable system)
Low
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None
Exploit maturity
Not defined
Scope
X

CVSS 3.1 8.0

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector
Adjacent
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it
  • Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  • Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-7hp6-4w63-5g45
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
Critical Same weakness, CWE-269
GO-2026-6791
containerd CRI plugin: Checkpoint restore bypasses destination security context
High Same weakness, CWE-269
GHSA-pjr3-86v4-5p7w
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
Medium Same weakness, CWE-269
GHSA-v3p6-34mc-hj7v
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
High Same weakness, CWE-269
GHSA-4pvx-fwjj-8gpc
Ghost: Editors Could Promote Staff Users to Their Own Role
Medium Same weakness, CWE-269
CVE-2026-102490
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
High Known exploited Same weakness, CWE-269
GHSA-9qh4-3jw8-366w
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Critical Same weakness, CWE-269
GHSA-3w57-8xmc-8v26
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
High Same weakness, CWE-269
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor