DaystoPatch

BeyondTrustExploited incident

BeyondTrust Remote Support and Privileged Remote Access unauthenticated command injection (BT24-10)

CVE-2024-12356Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 19 Dec 2024

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    BeyondTrust security advisory BT24-10 (Wayback snapshot 2025-03-04)CuratedQuote verified

    A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

    Advisory 'Issue Date: 2024-12-16'; first public signal, shipped with patches. Earlier snapshots from December 2024 contain only a bot-check page, so a March 2025 snapshot is cited (no update date shown).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a241ca7e521ad740…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2024-12356ClaimedQuote verified17 Dec 2024, 04:29 UTC

    A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4fdfa1a19176c77b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet17 Dec 2024, 05:15 UTC

    ID: CVE-2024-12356

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-12356)ClaimedQuote verified19 Dec 2024

    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

    Added to CISA's KEV catalog on 2024-12-19.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet20 Dec 2024, 15:23 UTC

    BeyondTrust says hackers breached Remote Support SaaS instances # BeyondTrust # BeyondTrustSecureRemoteAccess # CVE_2024_12356 # CVE_2024_12686 https://www. bleepingcomputer.com/news/secu

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    BleepingComputer (Sergiu Gatlan, February 14, 2025)CuratedQuote not checked yet14 Feb 2025

    BeyondTrust revealed that attackers breached its systems and 17 Remote Support SaaS instances in early December using two zero-day bugs (CVE-2024-12356 and CVE-2024-12686) and a stolen API key.

    Retrospective report: exploitation in early December 2024, before the 2024-12-16 patch. Recorded as a world candidate for completeness; the advisory remains the earliest public signal.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    BeyondTrust security advisory BT24-10 (Wayback snapshot 2025-03-04)CuratedQuote verified

    Issue Date: 2024-12-16

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a241ca7e521ad740…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    BeyondTrust security advisory BT24-10 (Wayback snapshot 2025-03-04)CuratedQuote verified

    A patch has been applied to all RS/PRA cloud customers as of December 16, 2024 that remediates this vulnerability.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a241ca7e521ad740…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    BeyondTrust security advisory BT24-10 (Wayback snapshot 2025-03-04)CuratedQuote verified

    This issue is fixed through a patch available for all supported releases of RS & PRA 22.1.x and higher.

    On-premises patches BT24-10-ONPREM1/ONPREM2 by version; releases older than 22.1 must upgrade first. Assumed available at issue (the snapshot shows no update history).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a241ca7e521ad740…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

BeyondTrust remote support flaw used in December 2024 breach; patched Dec 16

An unauthenticated command-injection flaw in BeyondTrust Remote Support and Privileged Remote Access was used in attacks in early December 2024; BeyondTrust patched its cloud service and released on-premises patches on 16 December 2024.

In plain words

BeyondTrust's remote support software, which IT staff use to connect to and control other computers, had a flaw that let an outsider run commands without a password, and investigators say it was used in attacks in early December 2024. BeyondTrust patched its cloud service and released fixes for self-hosted servers on 16 December 2024. If we run this software on our own servers, the patch needs to be installed.

What happened and who is affected

What happened

On 16 December 2024 BeyondTrust published advisory BT24-10 for CVE-2024-12356, a command-injection flaw (CVSS 9.8) that lets an unauthenticated attacker run operating-system commands on Remote Support (RS) and Privileged Remote Access (PRA). It had patched all cloud customers that day and offered patches for self-hosted versions 22.1 and later. CISA listed it as exploited on 19 December. Later reporting on BeyondTrust's investigation says attackers had used this flaw, a second one (CVE-2024-12686) and a stolen API key in early December to reach 17 Remote Support SaaS customers.

Who is affected

Self-hosted BeyondTrust Remote Support and Privileged Remote Access 24.3.1 and earlier without patch BT24-10-ONPREM1 or BT24-10-ONPREM2; versions older than 22.1 must upgrade before patching. BeyondTrust cloud instances were patched by BeyondTrust.

CVE-2024-12356. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/beyondtrust-cve-2024-12356/

Affected products

  • BeyondTrust Remote Support (RS) 24.3.1 and earlier
  • BeyondTrust Privileged Remote Access (PRA) 24.3.1 and earlier
How we built this timeline

AUDIT 2 (23 Oct 2026, T2): exploited before a fix changed false -> true after searching later write-ups. BleepingComputer (14 Feb 2025), reporting BeyondTrust's completed investigation and Rapid7's analysis, says attackers breached BeyondTrust and 17 Remote Support SaaS instances 'in early December using two zero-day bugs (CVE-2024-12356 and CVE-2024-12686) and a stolen API key', i.e. before the 16 Dec 2024 patch;

Rapid7 found that exploiting CVE-2024-12356 relied on a PostgreSQL zero-day (CVE-2025-1094). The Hacker News (1 Feb 2025) is more cautious ('The exact details of the malicious activity are presently not known') but does not contradict it.

Related: beyondtrust-cve-2024-12686 (BT24-11, issued two days later, same products) is tracked separately because it has its own advisory and KEV date; press coverage at the time tied both to BeyondTrust's December 2024 Remote Support SaaS security incident, which we did not independently source, so reviewers may choose to merge them under the campaign rule.

Related

BeyondTrust report card