CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

Exploited in the wild Critical 9.8 Published 17 Dec 2024 Updated 21 Oct 2025

Unauthenticated attackers can inject commands executed as a site user in BeyondTrust PRA and RS products.

Exploited in the wild: Since 19 Dec 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-12356?

CVE-2024-12356 is a critical command injection vulnerability in BeyondTrust Privileged Remote Access, published on 17 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

Weakness: CWE-77

Which versions are affected by CVE-2024-12356?

It affects 2 products.

Products include Beyondtrust Privileged Remote Access, Beyondtrust Remote Support.

How do I fix CVE-2024-12356?

No fix has been published for CVE-2024-12356 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 27 Dec 2024.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-12356 being exploited?

Yes. Attackers have exploited CVE-2024-12356 in the wild since at least 19 Dec 2024.

Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-69c6-ccv7-v3g3.