CVE-2024-12356BeyondTrust PRA and Remote Support unauthenticated command injection
What broke
BeyondTrust Privileged Remote Access and Remote Support (BT24-10) executed operating-system commands from a malicious client request, with no login. CVSS 9.8. Disclosed 16 December 2024. CISA added it to KEV. Patched in RS/PRA 22.1.x and later trains. Hundreds of on-prem appliances were still on the internet weeks later.
Why it matters
PRA is how vendors and admins become a privileged user on someone else's box. Unauthenticated command injection there is a PAM incident: recorded sessions, vaulted credentials, and jump-host identity all sit behind that login. Same product class as ScreenConnect and Conjur.
What to do
- Patch PRA/RS. Confirm the build, including vendor-hosted and customer-hosted.
- If the appliance was reachable in December 2024, rotate every vaulted credential it could check out and review session recordings for gaps.
- Take PRA admin off the internet. The jump path is the product. The management plane is not.
After you patch
Remote management and support platforms are standing administrative access to every endpoint beneath them, which turns a single bypass into a many-customer incident.
- Revoke sessions and rotate the platform's own credentials, including agent enrolment keys.
- Review remote session logs for connections you cannot attribute to a technician.
- Look for independent egress the attacker may have added, such as new tunnel services or remote access tools on managed endpoints, because removing them from the console does not remove them from the network.
- Treat the platform as tier-zero privileged access in your access model going forward, not as IT tooling.
Sources
- NVD: CVE-2024-12356
- BeyondTrust BT24-10
- CISA KEV
Related identity CVEs
Related on Start with Identity
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M
- GlossaryPrivileged Remote Access (PRA)
Privileged remote access (PRA) is the brokering of administrative sessions to servers, network devices, databases and OT systems for remote employees, vendors a
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo