---
title: "Citrix Session Recording CVE-2024-8068/8069: In KEV"
url: https://erroneo.us/security/briefs/citrix-session-recording-cve-2024-8068-8069-kev/
description: "MSMQ deserialization in Citrix Session Recording gives NetworkService code execution. Fixed by Nov 2024 hotfixes (24.5.200.8 etc). Check servers."
type: security-brief
section: "Security Digest"
date_published: 2024-11-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-8068", "CVE-2024-8069"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Citrix Session Recording CVE-2024-8068/8069: In KEV

**Verdict: Check exposure.** Only Citrix Virtual Apps and Desktops sites that run a Session Recording server need to act: confirm it carries the November 2024 hotfix or a later release, and keep it off untrusted networks.

- **Who must act:** Citrix Virtual Apps and Desktops customers running a Session Recording server below the fixed hotfix for their release (2407 CR, 1912, 2203 or 2402 LTSR).
- **Who can relax:** Sites without the Session Recording component, NetScaler-only customers, and Session Recording servers already on the listed hotfixes or a later release.
- **Affected:** Citrix Session Recording before 2407 hotfix 24.5.200.8 (Current Release); 1912 LTSR before CU9 hotfix 19.12.9100.6; 2203 LTSR before CU5 hotfix 22.03.5100.11; 2402 LTSR before CU1 hotfix 24.02.1200.16
- **Fixed:** 2407 hotfix 24.5.200.8 and later; 1912 LTSR CU9 hotfix 19.12.9100.6 and later; 2203 LTSR CU5 hotfix 22.03.5100.11 and later; 2402 LTSR CU1 hotfix 24.02.1200.16 and later
- **CVEs:** CVE-2024-8068, CVE-2024-8069
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory Session Recording servers and record the installed Session Recording Server version.
2. Install the hotfix for your release from CTX691941 (CTX692047, CTX692044, CTX692045 or CTX692046) or move to a later supported release.
3. Restrict inbound HTTP/HTTPS and MSMQ (TCP 1801) on the Session Recording server to the VDAs and admin hosts that need it; never publish it to the internet.
4. If the server ran unpatched since November 2024, review it as a possibly compromised Windows host and rotate credentials used on it.

### How to check if you are affected

- Search IIS logs on the Session Recording server for POST requests to /msmq/ paths from hosts that are not VDAs.
- Look for child processes such as cmd.exe or powershell.exe spawned by SsRecStorageManager.exe or running as NETWORK SERVICE.
- Check for new services, scheduled tasks, local accounts or web files on the server created after November 2024 that nobody can explain.

## What happened

Session Recording is the Citrix Virtual Apps and Desktops component that records user sessions for audit and troubleshooting. Its Storage Manager service (`SsRecStorageManager.exe`) receives recordings through a Microsoft Message Queuing (MSMQ) queue. Sina Kheirkhah of watchTowr found that the installer gives anonymous users write access to that queue, and that the service deserializes queued messages with .NET's `BinaryFormatter`. Microsoft says that class "can't be made secure." The installer also turns on MSMQ over HTTP, so [watchTowr's write-up](https://labs.watchtowr.com/visionaries-at-citrix-have-democratised-remote-network-access-citrix-virtual-apps-and-desktops-cve-unknown/) shows a crafted HTTP POST to `/msmq/` reaching the queue even when TCP 1801 is closed.

Citrix published [CTX691941](https://support.citrix.com/external/article/691941/citrix-session-recording-security-bullet.html) on November 12, 2024. It describes two bugs. [CVE-2024-8068](https://www.cve.org/CVERecord?id=CVE-2024-8068) is privilege escalation to NetworkService by "an authenticated user in the same Windows Active Directory domain." [CVE-2024-8069](https://www.cve.org/CVERecord?id=CVE-2024-8069) is "limited remote code execution" as NetworkService by an authenticated user on the same intranet. Citrix scores each 5.1 under CVSS 4.0. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-8068) rates both 8.0 under CVSS 3.1 ([CVE-2024-8069](https://nvd.nist.gov/vuln/detail/CVE-2024-8069)).

The two sides disagreed in public. A Citrix spokesperson told [The Register](https://www.theregister.com/2024/11/12/http_citrix_vuln/) that "this is not an unauthenticated RCE." watchTowr said Citrix was downplaying the bug. [Cybersecurity Dive](https://www.cybersecuritydive.com/news/citrix-session-recording-cves-hackers/732794/) reported that Shadowserver saw exploit attempts based on the public proof of concept soon after disclosure. CISA added both CVEs to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8069) on August 25, 2025. CISA has not said what exploitation prompted the listing, and [The Hacker News](https://thehackernews.com/2025/08/cisa-adds-three-exploited.html) notes it gave no details on the activity or the actors.

## Who is affected

Only sites that installed the Session Recording server. Affected builds are those before 2407 hotfix 24.5.200.8 (Current Release), 1912 LTSR CU9 hotfix 19.12.9100.6, 2203 LTSR CU5 hotfix 22.03.5100.11 and 2402 LTSR CU1 hotfix 24.02.1200.16. Citrix first listed the product as Virtual Apps and Desktops and changed it to Session Recording on November 14, 2024. NetScaler is a different product; see our briefs on [Citrix Bleed](https://erroneo.us/security/briefs/citrix-bleed-netscaler-cve-2023-4966/) and [Citrix Bleed 2](https://erroneo.us/security/briefs/citrix-bleed-2-netscaler-cve-2025-5777/).

## Do you really need to act?

Only if you run Session Recording. Even Citrix's narrower reading leaves the server open to any domain user or anyone on the internal network, a short step for an attacker with one phished account. The server stores recordings of user sessions, including keystrokes and mouse movements, so code running on it is valuable. The fix has been out for almost two years, and watchTowr says restricting MSMQ would likely break the product. Patch, then limit who can reach the server.

## What to do now

1. Check the version on each Session Recording server: `Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Session Recording*' | Select-Object DisplayName, DisplayVersion`.
2. Install the hotfix for your release (CTX692047, CTX692044, CTX692045 or CTX692046, linked from CTX691941), or move to a later supported release.
3. See whether MSMQ over HTTP is present with `Get-WindowsFeature MSMQ-HTTP-Support`. Firewall the server so only VDAs and admin hosts reach HTTP/HTTPS and TCP 1801.
4. If it ran unpatched, rotate credentials used on it and review who can play back recordings.

## How to tell if you were hit

Search IIS logs (by default under `C:\inetpub\logs\LogFiles`) for POST requests to `/msmq/` from addresses that are not your VDAs. In EDR data, look for `cmd.exe`, `powershell.exe` or other children of `SsRecStorageManager.exe`, or new processes running as NETWORK SERVICE. Then check for services, scheduled tasks or local accounts created after November 2024 that nobody can explain.

## Timeline

- Jul 14, 2024 — watchTowr reports the issue to Citrix.
- Aug 11, 2024 — After Citrix says it cannot reproduce the issue, watchTowr sends a video and proof of concept.
- Nov 12, 2024 — Citrix publishes CTX691941 with hotfixes, and watchTowr publishes its research.
- Nov 14, 2024 — Citrix renames the affected product to Session Recording in the bulletin.
- Aug 25, 2025 — CISA adds both CVEs to KEV.
- Sep 15, 2025 — CISA's remediation deadline for federal agencies.

## Sources

1. [Citrix — CTX691941: Citrix Session Recording Security Bulletin for CVE-2024-8068 and CVE-2024-8069](https://support.citrix.com/external/article/691941/citrix-session-recording-security-bullet.html)
2. [CVE record — CVE-2024-8068](https://www.cve.org/CVERecord?id=CVE-2024-8068)
3. [CVE record — CVE-2024-8069](https://www.cve.org/CVERecord?id=CVE-2024-8069)
4. [NVD — CVE-2024-8068](https://nvd.nist.gov/vuln/detail/CVE-2024-8068)
5. [NVD — CVE-2024-8069](https://nvd.nist.gov/vuln/detail/CVE-2024-8069)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-8068](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8068)
7. [CISA — Known Exploited Vulnerabilities: CVE-2024-8069](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8069)
8. [watchTowr Labs — Visionaries Have Democratised Remote Network Access (CVE-2024-8068 and CVE-2024-8069)](https://labs.watchtowr.com/visionaries-at-citrix-have-democratised-remote-network-access-citrix-virtual-apps-and-desktops-cve-unknown/)
9. [The Register — Exploit code released for RCE attack on Citrix VDI solution](https://www.theregister.com/2024/11/12/http_citrix_vuln/)
10. [Cybersecurity Dive — Citrix Session Recording users warned of CVEs that allow hackers to gain control](https://www.cybersecuritydive.com/news/citrix-session-recording-cves-hackers/732794/)
11. [The Hacker News — CISA adds three exploited vulnerabilities to KEV catalog affecting Citrix and Git](https://thehackernews.com/2025/08/cisa-adds-three-exploited.html)

---
Source page: https://erroneo.us/security/briefs/citrix-session-recording-cve-2024-8068-8069-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt