CVE-2024-12356: BeyondTrust PRA and RS unauthenticated command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityPre-auth network command injection with a 9.8 CVSS score, active KEV listing, and near-maximum EPSS probability make this an urgent patch-or-isolate case.

What it is

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection flaw (CWE-77) that lets an unauthenticated attacker inject commands executed as a site user. With a CVSS 3.1 score of 9.8 and network reachability with no privileges or user interaction, this is a severe pre-auth remote code execution risk for exposed deployments.

Impact

An attacker gains arbitrary command execution in the context of a site user on the affected appliance, which can lead to full compromise of the remote access platform and any credentials or sessions it brokers.

Attack surface

Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N) required, per the CVSS vector. The description does not specify the exact endpoint or protocol, so defenders should treat any internet-exposed PRA/RS interface as in scope.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-12-19 with a 2024-12-27 remediation due date, and EPSS shows a 30-day probability of 0.87991 (99.756th percentile). A reference is tagged Exploit, indicating public exploit analysis exists; no ransomware campaign use is documented.

What to do

• Apply the vendor patch or mitigations from BeyondTrust advisory BT24-10 immediately.
• If patching is not possible, remove internet exposure of PRA and RS interfaces or discontinue use per CISA guidance.
• Restrict management and remote access interfaces to trusted networks or VPN, and block unnecessary inbound access.
• Rotate credentials and secrets that were accessible to the affected appliance, since commands run as a site user.
• Review logs and configurations for signs of prior compromise before restoring normal exposure.

Detection

• Hunt for unexpected child processes or shell invocations spawned by the PRA/RS web service on the appliance.
• Monitor appliance and web logs for anomalous requests to PRA/RS endpoints, especially from unfamiliar source IPs.
• Alert on new or modified files, scheduled tasks, or outbound connections originating from the PRA/RS host.
• Correlate authentication and session records for site users with command execution events around the same timeframe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.