CVE-2024-12356 - BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability
Project:BeyondTrust
Product:Privileged Remote Access (PRA) and Remote Support (RS)
Date Added:2024-12-19Due Date:2024-12-27
Vulnerability Name
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability
Description
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
Known To Be Used in Ransomware Campaigns?
Unknown
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://www.beyondtrust.com/trust-center/security-advisories/bt24-10
https://nvd.nist.gov/vuln/detail/CVE-2024-12356
Related News Articles
BeyondTrust Flaw Used for Web Shells, Backdoors, and Data ExfiltrationFebruary 20, 2026
CISA gives feds 3 days to patch actively exploited BeyondTrust flawFebruary 16, 2026
BeyondTrust warns of critical RCE flaw in remote support softwareFebruary 9, 2026
BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731)February 9, 2026
BeyondTrust warns of pre-auth RCE in Remote Support softwareJune 18, 2025