CVE-2024-12356criticalunder attackCWE-77

CVE-2024-12356: critical vulnerability in BeyondTrust Remote Support

Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)

Published · Updated

Follow this CVE+ Monitor Remote Support+ Monitor Privileged Remote Access

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 87%
from disclosure to weapon629 days
Published on NVDDec 17
1st PoC+629d
metasploitDec 16
CISA KEV+2d
Action required by CISAfederal deadline: 2024-12-27

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An attacker without login credentials can inject malicious commands into Remote Support or Privileged Remote Access systems, which then run with site user permissions. This allows complete system compromise.

Technical detail

CWE-77 command injection in PRA/RS products enables unauthenticated remote code execution through unsanitized input. The vulnerability permits arbitrary command execution in the security context of the site user, exposing the entire system to compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
BeyondTrust · Privileged Remote AccessBeyondTrust · Remote Support
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — BeyondTrust Remote Support

In the same product, most dangerous first.

CVE-2026-102764CRITICALImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote SupportEPSS 78.0%KEVCVE-2026-40139CRITICALCritical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.8%CVE-2026-40140HIGHHigh-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.6%CVE-2026-40141HIGHHigh-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%CVE-2026-40138CRITICALCritical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%CVE-2025-0217HIGHPrivileged Remote Access Authentication BypassEPSS 0.2%