CVE-2024-12686

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
BeyondTrust	Remote Support(RS) & Privileged Remote Access(PRA)	<= 24.3.1

References

https://nvd.nist.gov/vuln/detail/CVE-2024-12686Third Party Advisory, US Government Resource
https://www.beyondtrust.com/trust-center/security-advisories/bt24-11Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686US Government Resource

Timeline

Published: Dec 18, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 13, 2025
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-126879.8Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes. Thi CVE-2024-12696.1A vulnerability has been found in SourceCodester Product Management System 1.0 and classified as problematic. This vulnerability affects unk CVE-2024-126928.8Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2024-126938.8Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sand CVE-2024-126948.8Use after free in Compositing in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via CVE-2024-126958.8Out of bounds write in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2024-126966.4The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug CVE-2024-126976.4The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficie CVE-2024-126986.5An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only una CVE-2024-126996.4The Service Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.9 due to insuffici CVE-2024-127008.8There is an unrestricted file upload vulnerability where it is possible for an authenticated user (low privileged) to upload an jsp shell an CVE-2024-127016.1The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’