Citrix Session Recording is subject to an actively exploited privilege escalation vulnerability that can be chained to achieve remote code execution with SYSTEM privileges.

The flaw is an improper privilege management issue that allows an authenticated user within the same Windows Active Directory domain to escalate their privileges to the NetworkService account. When chained with CVE-2024-8069, this issue facilitates full remote code execution with SYSTEM-level privileges.

The severity of this vulnerability is underscored by its CVSS score of 9.5 and its inclusion in the CISA Known Exploited Vulnerabilities catalog. Successful exploitation grants an attacker high-level access to the session recording server, potentially leading to total system compromise, unauthorized data exfiltration, and significant operational disruption. The ability to chain this vulnerability for SYSTEM-level access poses an existential risk to the integrity and confidentiality of the entire Citrix environment.

Immediate Action: Administrators must immediately apply the relevant hotfix for their specific release: 24.5.200.8 for 2407, 19.12.9100.6 for 1912 LTSR, 22.03.5100.11 for 2203 LTSR, or 24.02.1200.16 for 2402 LTSR.

Proactive Monitoring: Security teams should monitor Active Directory logs for anomalous authentication patterns or unexpected service account activity originating from standard user accounts.

Compensating Controls: While patching is the only definitive fix, ensure the Session Recording server is isolated within the network and restrict access to the server to only necessary administrative personnel to minimize the attack surface.

Public Exploit Available: Yes, a public proof-of-concept exists via GitHub.

Due to the confirmed active exploitation and the high severity of this vulnerability, immediate patching is mandatory. Organizations must prioritize the deployment of the provided Citrix hotfixes to prevent attackers from escalating privileges to the SYSTEM level. Failure to act promptly significantly increases the risk of a full-scale security incident involving unauthorized system control.