CRITICAL Actively exploited CWE-77
CVE-2024-12356
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
BeyondTrust·Privileged Remote Access (PRA) and Remote Support (RS)
9.8/ 10
CVSS 3.1
Critical severity
87%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.8% of all CVEs
Listed
CISA KEV catalog
- Added
- Dec 19, 2024
- Fix due
- Dec 27, 2024
- Ransomware
- Not known
Timeline
- Published
- Dec 17, 2024
- Updated
- Oct 21, 2025
- First covered
- Jul 7, 2026
- Latest story
- 4 months ago
Summary
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected products
- BeyondTrust Remote Supportup to 24.3.1
- BeyondTrust Privileged Remote Accessup to 24.3.1