Citrix · Session Recording
CVE-2024-8068
Privilege escalation to NetworkService Account access
ما هي
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
CISA: Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
ما العمل
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
الموعد النهائي للوكالات الفدرالية الأمريكية: 15 سبتمبر 2025
ثغرات مُستغلّة أخرى من Citrix
| أُضيفت | الثغرة | المنتج | الخطورة | احتمال الهجوم |
|---|---|---|---|---|
| 25/08/2025 | Deserialization of Untrusted Data | Session Recording | متوسطة 5.1 | 21% |
| 04/10/2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | مرتفع 8.7 | 11% |
| 27/09/2026 | Improper Input Validation | NetScaler | حرجة 9.5 | 82% |
| 27/09/2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | حرجة 9.5 | 78% |
| 09/09/2026 | Authentication Bypass Using an Alternate Path or Channel | NetScaler | حرجة 9.3 | 33% |
| 26/08/2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler ADC and NetScaler Gateway | مرتفع 8.8 | 1.0% |
| 30/03/2026 | Out-of-Bounds Read | NetScaler | حرجة 9.3 | 91% |
| 26/08/2025 | Memory Overflow | NetScaler | حرجة 9.2 | 21% |
المصادر: Known Exploited Vulnerabilities (CISA، ملكية عامة)، وCVE records (cve.org)، وEPSS (FIRST). احتمال الهجوم هو تقدير EPSS لاحتمال أن يحاول أحد استغلال الثغرة خلال الأيام الـ30 القادمة.