Cisa warns of actively exploited flaws in Citrix
Take action: If you are using Citrix and Virtual apps, the time for debate is over. Yes, the severity is low, but the flaws are being exploited. So don't wait, update your Citrix installations NOW!
Learn More
CISA is warning of active exploitation in Citrix. The vulnerabilities affect organizations using Citrix Session Recording solutions.
Vulnerabilities summary:
- CVE-2024-8069 (CVSS score 5.1), Citrix Session Recording Deserialization of Untrusted Data Vulnerability. It allows authenticated attackers who are on the same intranet as the Session Recording server to feed crafted serialized data that is processed insecurely, potentially achieving code execution with elevated privileges.
- CVE-2024-8068 (CVSS score 5.1), Citrix Session Recording Improper Privilege Management Vulnerability. It could allow for privilege escalation to NetworkService Account access when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain. This weakness enables threat actors to escalate privileges beyond their authorized access levels.
The flaws were patched by the company in November 2024 following responsible disclosure by watchTowr Labs on July 14, 2024. Despite patches being available for several months, there are still unpatched systems that are being actively attacked.
US Agencies must patch by September 15, 2025.
