# CVE-2024-8068: Citrix Session Recording Improper Privilege Management Vulnerability

- Exploited (CISA KEV): yes, added 2025-08-25
- Published: 2024-11-12
- CVSS: 5.1 MEDIUM (v4.0)
- EPSS: 3.5% (89th percentile)
- CWE: CWE-269

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-01-21 | 70 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2025-01-21 · new · rule 200204000
  > Added: signature 200204000 "Citrix Virtual Apps & Desktops Remote Code Execution" (Server Side Code Injection, risk High), systems: Citrix. References: CVE-2024-8068, CVE-2024-8069.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-03-11 · new · rule 200204000
  > Added: signature 200204000 "Citrix Virtual Apps & Desktops Remote Code Execution" (Server Side Code Injection, risk High), systems: Citrix. References: CVE-2024-8068, CVE-2024-8069.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-8068 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-8068