BeyondTrust Privileged Remote Access (PRA) & Remote Support (RS) Unauthenticated Remote Command Injection Vulnerability (CVE-2024-12356) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTBeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) affected versions
Unauthenticated remote attackers can inject and execute arbitrary system commands with the privileges of the 'site user'.
Immediately apply the official security patches provided by BeyondTrust (BT24-10) and restrict access to management interfaces.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Log in to the BeyondTrust Customer Portal to download and apply the latest secure software updates. For virtual appliances, use the administrative interface or CLI to trigger the update process.
# Example command to check and install the latest updates via the appliance CLI
update_check --install-latest2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the appliance's web and API interfaces using a firewall or reverse proxy to allow only trusted administrative IP addresses.
# Example Nginx configuration to restrict access to trusted subnets
location / {
allow 192.168.1.0/24;
allow 10.0.0.0/8;
deny all;
proxy_pass https://beyondtrust_appliance_backend;
}3. Log Audit & IoC Verification Commands
Search the appliance access logs for potential command injection patterns, such as shell metacharacters or suspicious command executions.
# Scan access logs for common command injection payloads and shell execution attempts
grep -Ei '(\||;|&&|\`|\$\(|echo|sh|bash|curl|wget)' /var/log/beyondtrust/access.logStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
CVE-2024-12356 is a critical command injection vulnerability (CWE-77) discovered in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). The root cause lies in the insufficient validation and sanitization of user-supplied inputs before passing them to system shell execution functions. This allows unauthenticated remote attackers to manipulate input parameters to execute arbitrary system commands.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending specially crafted HTTP requests containing shell metacharacters (such as ';', '&&', or '|') to the vulnerable endpoints of the appliance. Since the application fails to properly escape these inputs, the underlying operating system executes the injected commands under the context of the 'site user'. This vulnerability has been added to the CISA KEV catalog, indicating active exploitation in the wild.
3. Infrastructure & Business Impact
Because BeyondTrust PRA and RS serve as critical gateways for managing privileged access to internal enterprise networks, a successful compromise of these systems is highly damaging. Attackers can leverage this vulnerability to establish a persistent foothold, bypass authentication controls, harvest credentials, and perform lateral movement across the internal network, leading to potential full-scale infrastructure compromise.
Official Vendor Advisories & References
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
Frequently Asked SecOps Questions (CVE-2024-12356)
FAQQ1. How critical is CVE-2024-12356 and is it actively exploited in the wild?
CVE-2024-12356 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 87.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-12356?
Primary impacted vendors include beyondtrust across privileged remote access, remote support. Scope summary: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions specified in the BT24-10 vendor advisory
Q3. What temporary mitigations or workarounds exist for CVE-2024-12356 before patching?
[Mitigation] Immediately apply the official security patches provided by BeyondTrust (BT24-10) and restrict access to management interfaces. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-12356
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (beyondtrust)
View Category →BeyondTrust Remote Support and Privileged Remote Access Pre-Authentication Remote Code Execution (RCE) Vulnerability (CVE-2026-1731) Urgent Security Advisory
[Affected Scope] BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA).
BeyondTrust Remote Support Authentication Bypass and Arbitrary File Operation Advisory (CVE-2026-102764)
[Affected Scope] Internal messaging components of BeyondTrust Remote Support appliances.
Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
WAVLINK WL-WN579A3-A Router Initial Setup Wizard Remote Command Injection Vulnerability (CVE-2026-120195) Security Advisory
[Affected Scope] WAVLINK WL-WN579A3-A firmware version 2026-03-10-94f93d4 and prior.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.