CVE-2024-12686 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2024-12-18

Added to CISA KEV: 2025-01-13 26 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update to BeyondTrust RS/PRA version 24.3.2 or later
Review administrative access logs for suspicious command execution patterns
Implement additional monitoring for privilege escalation attempts
Consider temporary network segmentation if patching cannot be completed immediately
Audit administrative account access and review recent administrative actions

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2024-12686 is an OS command injection vulnerability affecting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products ^[1].

Vulnerability Overview and Impact

Nature of Vulnerability: This is an OS command injection vulnerability that allows an attacker to inject commands and execute them as a site user ^[1].
Exploitation Requirements: Unlike some other critical vulnerabilities, this flaw requires the attacker to already possess existing administrative privileges within the application ^[1] ^[2]. It is primarily considered a post-exploitation mechanism used to gain a stronger foothold or persist in an already compromised environment ^[3].
Impact: Successful exploitation allows for the execution of arbitrary commands and the uploading of malicious files, effectively granting the attacker elevated control over the affected instance ^[3].

Context and Exploitation

Active Exploitation: While the vulnerability was disclosed in December 2024, it has been noted in discussions alongside other vulnerabilities (such as CVE-2024-12356) in the context of high-profile security incidents, including reports of state-sponsored activity ^[4].
Ransomware/Targeted Attacks: The vulnerability is generally associated with targeted, post-exploitation activity rather than automated ransomware campaigns, given the requirement for prior administrative access to the system.

Affected Versions and Mitigation

Affected Products: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) ^[1].
Patch Status: BeyondTrust released patches for this vulnerability in December 2024 ^[2].

* Cloud Customers: Patches were automatically applied to all cloud instances by December 16, 2024 ^[2]. * On-Premise Customers: Administrators were required to apply the patch manually via the `/appliance` interface ^[2].

It is important to distinguish this from CVE-2024-12356, which was a separate, critical vulnerability in the same products that allowed for *unauthenticated* command injection ^[5]. The two are often mentioned together in security advisories from that period ^[2].

Sources

CVE-2024-12686 Detail - NVD
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative ... Secure .gov websites use HTTPS A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on offic…
BT24-11 | BeyondTrust
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative ... A patch has been applied to all RS/PRA cloud customers as of December 16, 2024 that remediates this vulnerability. On-premise customers of RS/PRA…
CVE-2024-12686 - Exploits & Severity - Feedly
CVE-2024-12686 is a medium-severity vulnerability that allows attackers with administrative privileges to upload malicious files and execute arbitrary commands, serving as a post-exploitation mechanism for gaining a stronger foothold in compromised environments. BeyondTrust has released patches for…
CVE-2024-30040 - Exploits & Severity - Feedly
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2024-26238, CVE-2024-29994, CVE-2024-29996, CVE-2024-29997, CVE-2024-29998, CVE-2024-29999, CVE-2024-30000, CVE-2024-30001, CVE-2024-30002, CVE-2024-30003, CVE-2024-30004, CVE-2024-30005, CVE-20…
NVD - CVE-2024-12356
CVE-2024-12356 Detail. Description. A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.CVE CISA KEV Update by Cybersecurity and Infrastructure Secur…