Citrix · Privilege escalation
Citrix Session Recording Privilege Escalation Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Citrix, treat it as High.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Do we run Citrix, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 11 Nov?
Next steps
- Confirm exposure, mitigation status and any service interruption risk.
Vulnerability facts
Full CVE detail CVE-2024-8068- 5.1 · MediumExploitable from the same local network with a low-privilege account, and no one has to click or open anything. Low impact on confidentiality, integrity and availability.CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Listed: attacks using it have been seen (on the catalogue since )
- ~3.5% estimated chance of attack in 30 days
No technical write-up beyond these facts and the summary below yet.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
- CVE-2024-8068 is listed in known-exploited catalogue (exploitation in the wild)
- Authoritative catalogues report active exploitation of this vulnerability.
Why this matters in the UK
- Known-exploited catalogue reports exploitation in the wild
Products and services involved
- Citrix92% match confidence · CVE-2024-8068
Pulse
Last checked 4d ago · Recheck overdue since 5 Nov 2026, 23:37 UK time · 1 quiet check collapsed
Suggested changed to 7d.
Listed on the — prioritise confirming exposure and patching.
1 quiet check hidden.
Sources
Citrix Session Recording Improper Privilege Management Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
Citrix Session Recording Improper Privilege Management Vulnerability
- ConfirmedSummary fact75% confidence
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain. Affects Citrix Session Recording. Known ransomware campaign use: Unknown.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2024-8068
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2024-8068 is listed in known-exploited catalogue (exploitation in the wild)