CVE-2024-12686

BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA)

Published 18 Dec 2024 · updated 17 Jun 2026 · Analyzed

7.2 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 13 Jan 2025, with a remediation deadline of 3 Feb 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.

References

nvd.nist.gov/vuln/detail/CVE-2024-12686 · Third Party Advisory, US Government Resource
www.beyondtrust.com/trust-center/security-advisories/bt24-11 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686 · US Government Resource