Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-8068

CVE-2024-8068MEDIUM

Citrix Citrix Session Recording — Privilege escalation to NetworkService Account access

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   L   N   L   L   L    5.1   .0348   88.7   YES

AFFECTED
  Product                   Versions                Fixed
  Citrix Session Recording  2407 Current Release –  —

TIMELINE
  Aug 21  Reserved by Citrix
  Nov 12  Published (CNA: Citrix)
  Aug 25  Added to CISA KEV, remediation due 2025-09-15

CWE-269 · CNA: Citrix · CVSS v4.0 · 2 references · KEV due September 15, 2025

Description

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 21, 2024	Reserved	Reserved by Citrix
November 12, 2024	Published	Published (CNA: Citrix)
August 25, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-09-15

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Citrix	Citrix Session Recording	—	2407 Current Release	—

Weaknesses

CWE-269

References (2)

Authoritative record: CVE-2024-8068 at cve.org

Vendors: citrix

Weaknesses: CWE-269

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-8068 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.