DaystoPatch

CitrixExploited incident

Citrix Session Recording deserialization RCE and privilege escalation

CVE-2024-8069, CVE-2024-8068Medium, CVSS 5.1In CISA's Known Exploited Vulnerabilities catalog since 25 Aug 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2024-8068 (CNA: Citrix), same bulletinCuratedQuote verified

    "datePublished":"2024-11-12T17:49:54.285Z"

    watchTowr published its technical write-up and PoC the same day (2024-11-12), reportedly before it knew the CVE IDs; its exact time was not established, so it may precede this record. Exploitation attempts were reported later.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3658de337dbbe312…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2024-8068ClaimedQuote verified12 Nov 2024, 17:49 UTC

    Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3658de337dbbe312…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet12 Nov 2024, 18:19 UTC

    ID: CVE-2024-8068

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-8068)ClaimedQuote verified25 Aug 2025

    Citrix Session Recording Improper Privilege Management Vulnerability

    Added to CISA's KEV catalog on 2025-08-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-8069)ClaimedQuote verified25 Aug 2025

    Citrix Session Recording Deserialization of Untrusted Data Vulnerability

    Added to CISA's KEV catalog on 2025-08-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2024-8068 (CNA: Citrix), same bulletinCuratedQuote verified

    "datePublished":"2024-11-12T17:49:54.285Z"

    CVE-2024-8069's record followed at 18:01:15Z.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3658de337dbbe312…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Citrix bulletin CTX691941CuratedQuote verified

    Citrix Session Recording 2407 hotfix 24.5.200.8 and later

    Hotfixes were linked from the bulletin; the only later changelog entry (2024-11-14) renamed the product.

    Source
    Citrix bulletin CTX691941 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd6fb75fec0c266b…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Citrix bulletin CTX691941CuratedQuote verified

    Citrix Session Recording 1912 LTSR CU9 hotfix 19.12.9100.6 and later

    Hotfixes for 2407 CR and the 1912, 2203 and 2402 LTSRs were all listed at publication.

    Source
    Citrix bulletin CTX691941 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd6fb75fec0c266b…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Citrix Session Recording
How we built this timeline

Coordinated disclosure on 12 Nov 2024; watchTowr (Sina Kheirkhah) published details and a PoC the same day and disputes Citrix's view that exploitation needs an authenticated domain user on the intranet. Exploitation attempts were reported after disclosure (SecurityWeek);

KEV added both CVEs on 25 Aug 2025, nine months later. Severity: Citrix CVSS v4.0 5.1 (medium) for both;

NVD gives CVE-2024-8069 v3.1 8.8. Changelog: 12 Nov 2024 initial publication; 14 Nov 2024 product renamed from 'Citrix Virtual Apps and Desktops' to 'Citrix Session Recording'.

The bulletin changelog reads '12 Nov 2024 Initial Publication' (date and text are separate table cells, so it is not used as a quote).

Related

No related incidents.

Citrix report card