The US cybersecurity agency CISA warns that a recently disclosed vulnerability in BeyondTrust’s remote access products has been exploited in the wild.

The issue, tracked as CVE-2024-12356 (CVSS score of 9.8), is a command injection bug impacting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) that can be exploited without authentication.

BeyondTrust released patches for the flaw last week, warning that it affects all PRA and RS versions up to 24.3.1 and urging customers to update their on-premises installations as soon as possible. The fixes were rolled out to cloud customers last week.

The company also revealed that CVE-2024-12356 was discovered during a forensic investigation into the compromise of a limited number of customers’ Remote Support SaaS instances, but did not clearly say whether the security defect was exploited in the attacks.

Responding to a SecurityWeek inquiry, a BeyondTrust spokesperson said that the company continues to investigate the incident, with help from independent third-party cybersecurity firms.

“At this time, BeyondTrust is focused on ensuring that all customer instances—both cloud and self-hosted—are fully updated and secure. Our priority remains supporting the limited number of customers impacted and safeguarding their environments. We will continue to provide regular updates via our website as our investigation progresses,” the company’s spokesperson said.

On Thursday, however, CISA added CVE-2024-12356 to its Known Exploited Vulnerabilities (KEV) list, warning of its in-the-wild exploitation and urging federal agencies to apply the available patches within one week, by December 27. Typically, federal agencies have three weeks to resolve flaws added to KEV.  

BeyondTrust, in the meantime, announced fixes for a second bug discovered during its investigation into the RS hacks. Tracked as CVE-2024-12686 (CVSS score of 6.6), the flaw could allow remote attackers with administrative privileges to upload malicious files.

“Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user,” BeyondTrust’s advisory reads.

Patches for the security defect were rolled out to cloud instances on December 16, but customers need to update their self-managed RS/PRA instances to apply the patch.

Related: Fortinet Patches Critical FortiWLM Vulnerability

Related: Android Zero-Day Exploited in Spyware Campaigns, Amnesty International Points to Cellebrite

Related: Microsoft Patches Vulnerabilities in Windows Defender, Update Catalog

Related: TP-Link Smart Bulb Vulnerabilities Expose Households to Hacker Attacks