high8.0Known exploited
CVE-2024-8069
Citrix Session Recording Deserialization of Untrusted Data Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-08-25. Federal due date: 2025-09-15.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Citrix | Session Recording | before 2407 Versions 1912, 2203, 2402, 2407 |