Deserialization of untrusted data in Citrix Session Recording
Priority HIGH 82Exploited in the wildCWE-502Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
Why it matters now
Exploitation Active In CISA KEV since 2025-08-25CISA due date 2025-09-15
EPSS 0.18194 97th percentileScored 2026-11-07
Fix Fixed Citrix Session Recording (Citrix Session Recording): 24.5.200.8, CU9 hotfix 19.12.9100.6, CU5 hotfix 22.03.5100.11 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Citrix Session Recording | Citrix Session Recording | 2407 Current Release to before 24.5.200.8; 1912 LTSR to before CU9 hotfix 19.12.9100.6; 2203 LTSR to before CU5 hotfix 22.03.5100.11; 2402 LTSR to before CU1 hotfix 24.02.1200.16 | 24.5.200.8, CU9 hotfix 19.12.9100.6, CU5 hotfix 22.03.5100.11, CU1 hotfix 24.02.1200.16 | Patch available | CNA |
- Citrix Session Recording VendorCitrix Session Recording Affected 2407 Current Release to before 24.5.200.8; 1912 LTSR to before CU9 hotfix 19.12.9100.6; 2203 LTSR to before CU5 hotfix 22.03.5100.11; 2402 LTSR to before CU1 hotfix 24.02.1200.16 Fixed in 24.5.200.8, CU9 hotfix 19.12.9100.6, CU5 hotfix 22.03.5100.11, CU1 hotfix 24.02.1200.16 Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:citrix:session_recording:*:*:*:*:-:*:*:* | before 2407 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:-:*:*:ltsr:*:*:* | 1912 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:cu1:*:*:ltsr:*:*:* | 1912 cu1 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:cu2:*:*:ltsr:*:*:* | 1912 cu2 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:cu3:*:*:ltsr:*:*:* | 1912 cu3 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:cu4:*:*:ltsr:*:*:* | 1912 cu4 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:cu5:*:*:ltsr:*:*:* | 1912 cu5 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:cu6:*:*:ltsr:*:*:* | 1912 cu6 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:cu7:*:*:ltsr:*:*:* | 1912 cu7 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:1912:cu8:*:*:ltsr:*:*:* | 1912 cu8 | Vulnerable | Citrix |
- cpe:2.3:a:citrix:session_recording:*:*:*:*:-:*:*:* Versions before 2407 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:-:*:*:ltsr:*:*:* Versions 1912 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:cu1:*:*:ltsr:*:*:* Versions 1912 cu1 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:cu2:*:*:ltsr:*:*:* Versions 1912 cu2 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:cu3:*:*:ltsr:*:*:* Versions 1912 cu3 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:cu4:*:*:ltsr:*:*:* Versions 1912 cu4 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:cu5:*:*:ltsr:*:*:* Versions 1912 cu5 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:cu6:*:*:ltsr:*:*:* Versions 1912 cu6 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:cu7:*:*:ltsr:*:*:* Versions 1912 cu7 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:1912:cu8:*:*:ltsr:*:*:* Versions 1912 cu8 Vulnerable ·Citrix
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:citrix:session_recording:2203:-:*:*:ltsr:*:*:* | 2203 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:2203:cu1:*:*:ltsr:*:*:* | 2203 cu1 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:2203:cu2:*:*:ltsr:*:*:* | 2203 cu2 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:2203:cu3:*:*:ltsr:*:*:* | 2203 cu3 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:2203:cu4:*:*:ltsr:*:*:* | 2203 cu4 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:2402:-:*:*:ltsr:*:*:* | 2402 | Vulnerable | Citrix |
| cpe:2.3:a:citrix:session_recording:2407:-:*:*:-:*:*:* | 2407 | Vulnerable | Citrix |
- cpe:2.3:a:citrix:session_recording:2203:-:*:*:ltsr:*:*:* Versions 2203 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:2203:cu1:*:*:ltsr:*:*:* Versions 2203 cu1 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:2203:cu2:*:*:ltsr:*:*:* Versions 2203 cu2 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:2203:cu3:*:*:ltsr:*:*:* Versions 2203 cu3 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:2203:cu4:*:*:ltsr:*:*:* Versions 2203 cu4 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:2402:-:*:*:ltsr:*:*:* Versions 2402 Vulnerable ·Citrix
- cpe:2.3:a:citrix:session_recording:2407:-:*:*:-:*:*:* Versions 2407 Vulnerable ·Citrix
Remediation
- Fix · CNA Citrix Session Recording (Citrix Session Recording) Fixed in 24.5.200.8, CU9 hotfix 19.12.9100.6, CU5 hotfix 22.03.5100.11, CU1 hotfix 24.02.1200.16
Timeline
- 2025-08-25 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2024-8069
- 2026-10-03 Alias added: GHSA-ww66-45gm-65fm
References
More Citrix Session Recording vulnerabilities
- TI-2024-07480 Improper privilege management in Citrix Session Recording KEVCVSS 4.0MEDIUM 5.1
Sources
- CVE-2024-8069 · CVE Program
- CVE-2024-8069 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-ww66-45gm-65fm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences