Beyondtrust Privileged Remote Access vulnerabilities

CVE-2026-1731 [CRITICAL] CWE-78 CVE-2026-1731: BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

CVE-2024-12356 [CRITICAL] CWE-77 CVE-2024-12356: A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (R A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

CVE-2024-12686 [HIGH] CWE-78 CVE-2024-12686: A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.

CVE-2023-4310 [CRITICAL] CWE-77 CVE-2023-4310: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contai BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited through a malicious HTTP request. Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute underlying operating system commands within the context o

CVE-2025-5309 [CRITICAL] CWE-94 CVE-2025-5309: The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Se The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution.

CVE-2023-23632 [HIGH] CWE-287 CVE-2023-23632: BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authe BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions, allowing unauthorized access to jump items by guessing only the first character of the secret.

CVE-2025-0217 [HIGH] CWE-287 CVE-2025-0217: BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authenti BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the connection details of a ShellJump session that was initiated with external tools, allowing unauthorized access to connected sessions.