Citrix Session Recording CVE-2024-8068/8069: In KEV

What to do

1. Inventory Session Recording servers and record the installed Session Recording Server version.
2. Install the hotfix for your release from CTX691941 (CTX692047, CTX692044, CTX692045 or CTX692046) or move to a later supported release.
3. Restrict inbound HTTP/HTTPS and MSMQ (TCP 1801) on the Session Recording server to the VDAs and admin hosts that need it; never publish it to the internet.
4. If the server ran unpatched since November 2024, review it as a possibly compromised Windows host and rotate credentials used on it.

How to check if you are affected or compromised

• Search IIS logs on the Session Recording server for POST requests to /msmq/ paths from hosts that are not VDAs.
• Look for child processes such as cmd.exe or powershell.exe spawned by SsRecStorageManager.exe or running as NETWORK SERVICE.
• Check for new services, scheduled tasks, local accounts or web files on the server created after November 2024 that nobody can explain.

What happened#

Session Recording is the Citrix Virtual Apps and Desktops component that records user sessions for audit and troubleshooting. Its Storage Manager service (SsRecStorageManager.exe) receives recordings through a Microsoft Message Queuing (MSMQ) queue. Sina Kheirkhah of watchTowr found that the installer gives anonymous users write access to that queue, and that the service deserializes queued messages with .NET's BinaryFormatter. Microsoft says that class "can't be made secure." The installer also turns on MSMQ over HTTP, so watchTowr's write-up shows a crafted HTTP POST to /msmq/ reaching the queue even when TCP 1801 is closed.

Citrix published CTX691941 on November 12, 2024. It describes two bugs. CVE-2024-8068 is privilege escalation to NetworkService by "an authenticated user in the same Windows Active Directory domain." CVE-2024-8069 is "limited remote code execution" as NetworkService by an authenticated user on the same intranet. Citrix scores each 5.1 under CVSS 4.0. NVD rates both 8.0 under CVSS 3.1 (CVE-2024-8069).

The two sides disagreed in public. A Citrix spokesperson told The Register that "this is not an unauthenticated RCE." watchTowr said Citrix was downplaying the bug. Cybersecurity Dive reported that Shadowserver saw exploit attempts based on the public proof of concept soon after disclosure. CISA added both CVEs to the KEV catalog on August 25, 2025. CISA has not said what exploitation prompted the listing, and The Hacker News notes it gave no details on the activity or the actors.

Who is affected#

Only sites that installed the Session Recording server. Affected builds are those before 2407 hotfix 24.5.200.8 (Current Release), 1912 LTSR CU9 hotfix 19.12.9100.6, 2203 LTSR CU5 hotfix 22.03.5100.11 and 2402 LTSR CU1 hotfix 24.02.1200.16. Citrix first listed the product as Virtual Apps and Desktops and changed it to Session Recording on November 14, 2024. NetScaler is a different product; see our briefs on Citrix Bleed and Citrix Bleed 2.

Do you really need to act?#

Only if you run Session Recording. Even Citrix's narrower reading leaves the server open to any domain user or anyone on the internal network, a short step for an attacker with one phished account. The server stores recordings of user sessions, including keystrokes and mouse movements, so code running on it is valuable. The fix has been out for almost two years, and watchTowr says restricting MSMQ would likely break the product. Patch, then limit who can reach the server.

What to do now#

1. Check the version on each Session Recording server: Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Session Recording*' | Select-Object DisplayName, DisplayVersion.
2. Install the hotfix for your release (CTX692047, CTX692044, CTX692045 or CTX692046, linked from CTX691941), or move to a later supported release.
3. See whether MSMQ over HTTP is present with Get-WindowsFeature MSMQ-HTTP-Support. Firewall the server so only VDAs and admin hosts reach HTTP/HTTPS and TCP 1801.
4. If it ran unpatched, rotate credentials used on it and review who can play back recordings.

How to tell if you were hit#

Search IIS logs (by default under C:\inetpub\logs\LogFiles) for POST requests to /msmq/ from addresses that are not your VDAs. In EDR data, look for cmd.exe, powershell.exe or other children of SsRecStorageManager.exe, or new processes running as NETWORK SERVICE. Then check for services, scheduled tasks or local accounts created after November 2024 that nobody can explain.

Timeline#

• Jul 14, 2024 — watchTowr reports the issue to Citrix.
• Aug 11, 2024 — After Citrix says it cannot reproduce the issue, watchTowr sends a video and proof of concept.
• Nov 12, 2024 — Citrix publishes CTX691941 with hotfixes, and watchTowr publishes its research.
• Nov 14, 2024 — Citrix renames the affected product to Session Recording in the bulletin.
• Aug 25, 2025 — CISA adds both CVEs to KEV.
• Sep 15, 2025 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2024-8068 · KEV 2025-08-25 · Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active…
• CVE-2024-8069 · KEV 2025-08-25 · Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Citrix — CTX691941: Citrix Session Recording Security Bulletin for CVE-2024-8068 and CVE-2024-8069 support.citrix.com
2. CVE record — CVE-2024-8068 cve.org
3. CVE record — CVE-2024-8069 cve.org
4. NVD — CVE-2024-8068 nvd.nist.gov
5. NVD — CVE-2024-8069 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2024-8068 cisa.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2024-8069 cisa.gov
8. watchTowr Labs — Visionaries Have Democratised Remote Network Access (CVE-2024-8068 and CVE-2024-8069) labs.watchtowr.com

Coverage and analysis

1. The Register — Exploit code released for RCE attack on Citrix VDI solution theregister.com
2. Cybersecurity Dive — Citrix Session Recording users warned of CVEs that allow hackers to gain control cybersecuritydive.com
3. The Hacker News — CISA adds three exploited vulnerabilities to KEV catalog affecting Citrix and Git thehackernews.com