CVE-2024-8069
Citrix Session Recording Deserialization of Untrusted Data Vulnerability
Published Nov 12, 2024 · updated Jun 17, 2026 · citrix session recording
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
Timeline
Detection, updates, and resolution for this record.
Nov 12, 2024 · Catalog
Detected
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
Aug 25, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Sep 15, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Sep 15, 2025
Affected
- cpe citrix/session recordingversion unspecified
- cpe citrix/session recording1912
- vendor Citrix Session Recordingversion unspecified
Sources
- CISA KEVCVE-2024-8069
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
cisa.gov - CVE.orgCVE-2024-8069
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-8069
30-day exploitation probability 14.6%
first.org - NIST NVDCVE-2024-8069
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
nvd.nist.gov