By year
17
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited BeyondTrust flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by SpoofingExploited since Oct 16, 2026 · CVSS 9.3
- CVE-2026-1731 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command InjectionExploited since Feb 13, 2026 · ransomware · CVSS 9.9
- CVE-2024-12686 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command InjectionExploited since Jan 13, 2025 · CVSS 6.6
- CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability Exploited since Dec 19, 2024 · CVSS 9.8
Latest high and critical flaws
- CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by SpoofingExploited · Critical 9.3 · Oct 15, 2026
- CVE-2026-40145 A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controlHigh 7.1 · Aug 17, 2026
- CVE-2026-40144 A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2.High 7.3 · Aug 17, 2026
- CVE-2026-40141 A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certHigh 8.5 · Jul 6, 2026
- CVE-2026-40140 BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem.High 8.7 · Jul 6, 2026
- CVE-2026-40139 A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support.Critical 9.2 · Jul 6, 2026
- CVE-2026-40138 A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access.Critical 9.2 · Jul 6, 2026
- CVE-2026-1731 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command InjectionExploited · Critical 9.9 · Feb 6, 2026
- CVE-2025-6250 Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections.High 7.1 · Jul 28, 2025
- CVE-2025-2297 Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user rHigh 7.2 · Jul 28, 2025
- CVE-2025-5309 The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead toHigh 8.6 · Jun 16, 2025
- CVE-2025-0217 BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass.High 7.3 · May 5, 2025
- CVE-2025-0889 Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM obHigh 7.2 · Feb 26, 2025
- CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability Exploited · Critical 9.8 · Dec 17, 2024
- CVE-2024-4018 Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This High 8.8 · Apr 19, 2024
- CVE-2024-4017 Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (filesystem modules) allows DLL Side-Loading.This issue affectsHigh 8.8 · Apr 19, 2024
- CVE-2020-28369 In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location High 7.8 · Dec 12, 2023
- CVE-2020-12614 An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.High 7.8 · Dec 12, 2023
- CVE-2020-12612 An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.High 7.8 · Dec 12, 2023
- CVE-2020-12615 An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.High 7.8 · Dec 12, 2023
- CVE-2021-3187 An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7.High 8.8 · Dec 11, 2023
- CVE-2020-12613 An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.High 8.8 · Dec 11, 2023
- CVE-2023-23632 BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass.High 7.8 · Oct 12, 2023
- CVE-2023-4310 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited tCritical 9.8 · Sep 5, 2023
- CVE-2021-42254 BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions.High 7.8 · Nov 19, 2021
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.