The Long Tail of BeyondTrust [CVE-2024-12356]

Censys Research Team details a critical remote command injection (CVE-2024-12356) affecting BeyondTrust PRA and RS products; patches were issued but numerous on-premises instances remain exposed. The report documents evidence of exploitation by a Chinese state-backed actor using a stolen BeyondTrust API key against the U.S. Treasury and some SaaS customers, highlights exposure counts (778 inferred vulnerable on-prem hosts; 23,743 exposed hosts overall), and warns of a prolonged window of opportunity for attackers.