CVE-2024-8069CitrixServers and softwareAugust 25, 2025

Citrix Session Recording Deserialization of Untrusted Data Vulnerability

High 8Actively exploited

Description

Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Running Citrix devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Citrix alerts

Details

Vendor
Citrix
Product
Citrix Session Recording
CVE
CVE-2024-8069
Affected versions
Session Recording 1912: 1912 – 1912 CU8
Session Recording 2203: 2203 – 2203 CU4
Session Recording 2402: 2402
Session Recording 2407: 2407 (from the advisory and NVD; check the exact builds in the official advisory)
CVSS score
8
Actively exploited
Yes, listed in the CISA Known Exploited Vulnerabilities catalog
CISA due date
September 15, 2025 (deadline for US federal agencies: a good benchmark for you too)
Source
CISA KEV – original advisory
Published
August 25, 2025

The description and the recommended action are quoted from the public advisory; severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More Citrix advisories