CVE-2024-12356

A critical vulnerability has been identified in Privileged Remote Access (PRA) and Remote Support (RS) products, allowing unauthenticated attackers to inject commands that execute with the privileges of a site user. This flaw arises from improper input validation and insufficient authentication mechanisms, enabling malicious actors to bypass security controls. The vulnerability can be exploited through various methods, including sending specially crafted requests to the affected systems, which can lead to unauthorized command execution. The ability to run arbitrary commands poses a significant risk, as attackers can manipulate system configurations, access sensitive data, or even pivot to other systems within the network.

The attack vectors associated with this vulnerability are particularly concerning due to the nature of the affected products. Attackers can exploit this flaw remotely, meaning that they do not require physical access to the network or system. This remote exploitation capability allows for a wide range of potential scenarios. For instance, an attacker could leverage social engineering tactics to trick a legitimate user into accessing a malicious link, which then triggers the command injection. Alternatively, automated scripts could be deployed to scan for vulnerable instances of the PRA and RS products, enabling mass exploitation across multiple organizations. Once the attacker gains access, they can execute commands to install malware, exfiltrate sensitive information, or disrupt services.

The real-world impact of this vulnerability is profound, particularly for organizations that rely on these remote access solutions for critical operations. The high CVSS score of 9.8 indicates the severity of the risk, suggesting that successful exploitation could lead to significant data breaches or operational disruptions. Businesses that utilize these products may face not only immediate financial losses due to theft or damage but also long-term repercussions such as reputational harm, regulatory fines, and loss of customer trust. The potential for attackers to gain footholds within corporate networks amplifies the risk, as they can leverage this access to conduct further attacks or lateral movements within the infrastructure.

To effectively detect and mitigate this vulnerability, organizations should adopt a multi-layered security approach. Regularly updating and patching affected products is crucial, as vendors typically release security updates to address known vulnerabilities. Additionally, implementing robust network segmentation can help limit the potential impact of an attack by isolating critical systems from less secure environments. Organizations should also employ intrusion detection systems (IDS) to monitor for unusual activity indicative of exploitation attempts. Furthermore, conducting regular security assessments and penetration testing can help identify weaknesses in the environment, allowing for proactive remediation before an attacker can exploit them.

In conclusion, the vulnerability in Privileged Remote Access and Remote Support products presents a critical threat that organizations must address promptly. The combination of remote exploitation capabilities and the potential for high-impact consequences necessitates immediate action. By understanding the technical details, potential attack vectors, and real-world implications, organizations can better prepare their defenses. Implementing effective detection and mitigation strategies will be essential in safeguarding sensitive information and maintaining operational integrity in an increasingly complex threat landscape.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2024-12356, coinciding with the recent addition of this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog. Our telemetry indicates the emergence of new proof-of-concept exploits, including a Metasploit module enabling unauthenticated remote code execution against affected BeyondTrust Privileged Remote Access and Remote Support versions. Although the EPSS score remains stable at a high level, the slight upward adjustment reflects growing attacker interest and potential for widespread exploitation. This development elevates the operational risk for organizations running vulnerable versions, as adversaries now possess accessible, automated tools to leverage the critical flaw. Consequently, the threat landscape has intensified, underscoring an urgent need for heightened monitoring and rapid response capabilities to counteract active exploitation efforts.

Update 2 — July 09, 2026

CSURFACE threat intelligence has detected a notable surge in exploitation attempts targeting the critical vulnerability in BeyondTrust Privileged Remote Access and Remote Support products. Our telemetry indicates an increased frequency of command injection activity consistent with unauthenticated remote code execution attempts, reflecting a growing attacker focus on this vector. While the EPSS score remains stable, the uptick in observed exploitation signals a shift from theoretical risk to active operational threat, heightening the urgency for defenders to recognize this vulnerability as a live attack surface. The availability of a Metasploit module continues to lower the barrier for adversaries, facilitating broader exploitation efforts. This escalation underscores a heightened threat level, as attackers increasingly leverage automated tools to compromise vulnerable environments, potentially leading to unauthorized access and lateral movement within targeted networks.

Update 3 — July 18, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2024-12356, with detection activity doubling over recent monitoring periods. This surge reflects a transition from limited probing to more aggressive and frequent attack campaigns, underscoring that adversaries are increasingly prioritizing this vulnerability. While the EPSS score remains high but stable, the sharp increase in telemetry signals a growing operational focus on BeyondTrust Remote Support environments, likely driven by the ease of exploitation afforded by publicly available Metasploit modules. This intensification elevates the threat level from a theoretical or opportunistic risk to a sustained and active threat, increasing the likelihood of successful unauthorized command execution and potential lateral movement within compromised networks. Defenders should recognize that the vulnerability is now a prominent target in the wild, with adversaries leveraging automated tools to expand their foothold rapidly.

Update 4 — August 02, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting the BeyondTrust Remote Support vulnerability, with telemetry indicating a sustained uptick in attacker activity leveraging the publicly available Metasploit module. This increase reflects a growing operational prioritization by threat actors, suggesting that exploitation efforts are becoming more systematic rather than opportunistic. The persistence and expansion of these attempts underscore an elevated risk of unauthorized command execution within affected environments, potentially facilitating lateral movement and deeper network compromise. Although the EPSS score remains stable, the qualitative surge in exploitation signals a heightened threat environment that demands increased vigilance from defenders, as adversaries continue to refine and automate their attack methodologies against this critical vulnerability.