Critical severity9.8CISA KEVNVD Advisory· Published Dec 17, 2024· Updated Jun 17, 2026
CVE-2024-12356
CVE-2024-12356
Description
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*Range: <=24.3.1
cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*range: <=24.3.1
- (no CPE)
- (no CPE)range: 0
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
5- attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysisnvdExploitThird Party Advisory
- nvd.nist.gov/vuln/detail/CVE-2024-12356nvdThird Party AdvisoryUS Government Resource
- www.beyondtrust.com/trust-center/security-advisories/bt24-10nvdVendor Advisory
- www.cve.org/CVERecordnvdThird Party AdvisoryUS Government Resource
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
3- BeyondTrust warns of critical flaws in remote access softwareBleepingComputer · Jul 7, 2026
- BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRAThe Hacker News · Jul 7, 2026
- Exploits and vulnerabilities in Q1 2026Securelist · May 7, 2026