BeyondTrust Patches Critical Auth Bypass in Remote Support and PRA — Patch Now

BeyondTrust has disclosed and patched two critical authentication bypass vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. If exploited, either flaw allows an unauthenticated attacker to take full control of the affected appliance — no credentials required.

What Happened

BeyondTrust published advisories for two critical flaws in its RS and PRA platforms. The Hacker News confirmed that both CVEs are authentication bypass issues — not privilege escalation or post-auth issues — meaning exploitation requires zero prior access. BeyondTrust has released patched versions and is urging immediate deployment.

This is the same vendor that suffered a significant breach in late 2024 tied to a compromised API key, which led to downstream compromise of U.S. Treasury workstations. The pattern of targeting BeyondTrust infrastructure is established.

Why It Matters

BeyondTrust RS and PRA sit at the highest-privilege position in most enterprise environments: they broker administrative and vendor access to servers, network devices, and endpoints. An attacker who compromises the RS or PRA appliance gains a lateral movement launchpad into everything that software touches — often including systems otherwise isolated from the internet.

Critical auth bypass flaws in privileged access tools are the crown jewel vulnerability class. They are actively hunted by ransomware groups and nation-state actors because the blast radius is organization-wide. BeyondTrust's prior breach history means tooling to exploit their infrastructure may already exist in criminal markets.

Cloud-hosted BeyondTrust instances may receive patches automatically, but self-hosted deployments — common in regulated industries and government — require manual action.

What To Do

1. Identify your deployment type. Log into your BeyondTrust RS or PRA admin console and confirm whether you are on a cloud-managed or self-hosted/virtual appliance instance.
2. Apply the patch immediately. Follow BeyondTrust's official upgrade path for your version. Do not wait for a maintenance window — treat this as emergency patching.
3. Review access logs. Pull authentication and session logs covering the past 30 days. Look for sessions from unexpected source IPs, failed auth spikes followed by sudden success, or sessions initiated outside business hours.
4. Check vendor/third-party jump clients. If you use RS to broker vendor access, audit active and scheduled vendor sessions for anomalies.
5. Restrict network exposure. If patching will be delayed for any reason, restrict access to the RS/PRA web management interface to trusted IP ranges at the firewall level as an interim control.
6. Notify your IR team. Given BeyondTrust's breach history and the severity here, loop in your incident response capability proactively rather than reactively.