An attacker gained access to a limited number of BeyondTrust customers’ instances of Remote Support SaaS, an access-management tool, the company said in a Dec. 8 blog post, which was updated Wednesday. The attacker compromised a Remote Support SaaS API key and reset passwords of multiple accounts.
The cybersecurity vendor initially detected anomalous activity on one customer instance of Remote Support SaaS on Dec. 2, according to the updated blog. Three days later, the company determined multiple customers were impacted, suspended those instances and revoked the compromised API key.
“Our initial investigation has found that no BeyondTrust products outside of Remote Support SaaS are impacted,” the company said in the blog post.
BeyondTrust also identified and patched a pair of vulnerabilities in its Remote Support SaaS and Privileged Remote Access products, CVE-2024-12356 and CVE-2024-12686, during its investigation into the attacks. The vulnerabilities were disclosed and patched on Monday and Wednesday.
The company did not describe either flaw as actively exploited in its advisories, yet the Cybersecurity and Infrastructure Security Agency added CVE-2024-12356, a critical command injection vulnerability, to its known exploited vulnerabilities catalog on Thursday.
BeyondTrust hasn’t acknowledged a direct link between the attacks and the actively exploited critical CVE, which has a CVSS score of 9.8. The company did not respond to a request for comment.
A third-party cybersecurity and forensics firm is assisting BeyondTrust with an ongoing investigation into the attacks. The company said it has notified impact customers and will continue to share updates until the investigation concludes.
BeyondTrust said it had 20,000 customers across its product portfolio earlier this year, including 75 of the Fortune 100.
