BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 18, 2024 · Catalog

   Detected

   BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.

2. Jan 13, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Feb 3, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.

Affected

• cpe beyondtrust/privileged remote accessversion unspecified
• cpe beyondtrust/remote supportversion unspecified
• vendor BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)version unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2024-12686

  BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.

  cisa.gov
• CVE.orgVulnerability recordCVE-2024-12686

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2024-12686

  30-day exploitation probability 13.7%

  first.org
• NIST NVDVulnerability recordCVE-2024-12686

  A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• CISA note · beyondtrust.com
• US Government Resource · cisa.gov