CVE-2024-12686
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 February 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 32.22% probability · 98th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 13 January 2025 · due 3 February 2025
- Weakness
- CWE-78
- Affected
- beyondtrust/privileged remote access · beyondtrust/remote support
- Source
- 13061848-ea10-403d-bd75-c83a022c2891
EPSS moved from 32.2% on 25 October 2026 to 32.2% on 30 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.beyondtrust.com/trust-center/security-advisories/bt24-11 ; https://nvd.nist.gov/vuln/detail/CVE-2024-12686
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-12686Third Party Advisory, US Government Resource
- https://www.beyondtrust.com/trust-center/security-advisories/bt24-11Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.