CVE-2024-12356—BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

Vulnerability Name

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

Description

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

• https://www.beyondtrust.com/trust-center/security-advisories/bt24-10
• https://nvd.nist.gov/vuln/detail/CVE-2024-12356

Related News Articles

• BeyondTrust warns of critical flaws in remote access softwareJuly 7, 2026
• BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRAJuly 7, 2026
• BeyondTrust Flaw Used for Web Shells, Backdoors, and Data ExfiltrationFebruary 20, 2026
• CISA gives feds 3 days to patch actively exploited BeyondTrust flawFebruary 16, 2026
• BeyondTrust warns of critical RCE flaw in remote support softwareFebruary 9, 2026

Related Weaknesses

• CWE-77