Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .8726 99.7 YES
AFFECTED Product Versions Fixed Remote Support unspecified — Privileged Remote Access unspecified —
TIMELINE Dec 8 Reserved by BT Dec 17 Published (CNA: BT) Dec 19 Added to CISA KEV, remediation due 2024-12-27
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
| Date | Event | Detail |
|---|---|---|
| December 8, 2024 | Reserved | Reserved by BT |
| December 17, 2024 | Published | Published (CNA: BT) |
| December 19, 2024 | KEV ADDED | Added to CISA KEV, remediation due 2024-12-27 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| BeyondTrust | Remote Support | — | — | — |
| BeyondTrust | Privileged Remote Access | — | — | — |
Authoritative record: CVE-2024-12356 at cve.org
Vendors: beyondtrust
Weaknesses: CWE-77
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-12356 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
