Risk Letters
About Sign in ENDA

Exploited vulnerability

CVE-2024-8068

TLP:CLEAR

Citrix Session Recording Improper Privilege Management Vulnerability

Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.

Facts

  • Vendor: Citrix
  • Product: Session Recording
  • CVSS: 5.1
  • EPSS (probability of exploitation within 30 days): 3.5 %
  • On CISA's Known Exploited Vulnerabilities list since: 25 August 2025
  • First known exploitation: 25 August 2025
  • CISA's deadline for US federal agencies: 15 September 2025
  • Weakness: CWE-269
  • First seen by Risk Letters: 25 August 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD

© The Risk Letters 2026 · Privacy policy · Terms of sale · Refund policy