Actively exploited in the wild
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability
BeyondTrust - Privileged Remote Access (PRA) and Remote Support (RS) · Listed in the CISA KEV since 2025-01-13. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-12686
MediumCVSS 6.6KEVSummary
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
Risk Assessment
An attacker with administrative privileges could escalate privileges and execute commands as a site user, potentially leading to further system compromise.
Recommendation
Update the software to the latest version and restrict administrative privileges to the minimum necessary.
Other vulnerabilities in Privileged Remote Access (PRA) and Remote Support (RS)
Original NVD description (English source)
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.