CVE-2024-12356

BeyondTrust Remote Support, BeyondTrust Privileged Remote Access

Published 17 Dec 2024 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 19 Dec 2024, with a remediation deadline of 27 Dec 2024 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

References

nvd.nist.gov/vuln/detail/CVE-2024-12356 · Third Party Advisory, US Government Resource
www.beyondtrust.com/trust-center/security-advisories/bt24-10 · Vendor Advisory
www.cve.org/CVERecord?id=CVE-2024-12356 · Third Party Advisory, US Government Resource
attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis · Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12356 · US Government Resource