Despite weeks of warnings about an actively exploited critical vulnerability in BeyondTrust systems, thousands of instances remain exposed to the internet. Cybersecurity researchers are sounding alarms about the ongoing risk, particularly as Chinese state-sponsored hackers have already weaponized the flaw to breach high-profile targets like the US Treasury Department.
A Persistent Problem: 9,000 Instances Still at Risk
The vulnerability, CVE-2024-12356, carries a severity score of 9.8 out of 10 and affects BeyondTrust’s Privileged Remote Access (PRA) and Remote Support (RS) systems. First disclosed by BeyondTrust on December 16, 2024, the flaw quickly made it onto the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities list. Days later, a Chinese state-backed group exploited it to infiltrate the US Treasury Department, stealing sensitive data and heightening concerns about its broader impact.
According to an analysis by Censys, 8,602 BeyondTrust instances are still publicly accessible on the internet, with 72% of those located in the United States. However, the true scope of vulnerability remains unclear. BeyondTrust has claimed all self-hosted systems were force-patched, but the company has not confirmed whether this applies to every open instance identified by Censys. Without direct confirmation, the exposed systems remain a question mark for cybersecurity teams worldwide.
Self-Hosted Systems: A Double-Edged Sword?
The lingering exposure appears tied to the operational choices of organizations using self-hosted BeyondTrust systems. These setups offer cost savings compared to cloud-hosted alternatives, but they shift the burden of patching and monitoring squarely onto the customer.
Trey Ford, CISO of Bugcrowd, points to this tradeoff as a key factor in the lagging response. “Hosted services offer economies of scale for detection, response, and centralized patching,” Ford explains. “Self-hosted models, while cost-effective, leave organizations isolated, responsible for maintaining their own defenses.”
While BeyondTrust cloud customers received automatic patches on December 16, 2024, self-hosted users faced delays in identifying, testing, and deploying updates. The disparity highlights a broader challenge in cybersecurity: the patch management gap between centralized and decentralized systems.
What Organizations Can Do Now
Even for self-hosted instances where patching is delayed or impossible, experts stress that there are ways to reduce exposure. John Bambenek, president of Bambenek Consulting, suggests limiting inbound access to trusted IP addresses.
“In cases where patching isn’t feasible, organizations should lock down inbound connectivity to known, trusted IPs,” Bambenek advises. “This step can significantly reduce the attack surface, especially for remote tools like BeyondTrust.”
Organizations are also being urged to:
- Audit their network configurations to ensure unnecessary access points are closed.
- Deploy firewalls or other network defenses to block unauthorized traffic.
- Regularly review and update their software to avoid similar vulnerabilities in the future.
Broader Implications for Cybersecurity
The BeyondTrust vulnerability has reignited debates about the sustainability of self-hosted software-as-a-service (SaaS) models. While cost savings are attractive, the responsibility for threat mitigation falls disproportionately on customers, who may lack the resources or expertise to respond effectively.
Ford underscores the advantages of cloud-hosted models for incident response. “Service providers can roll out patches immediately, protecting all customers simultaneously,” he says. “In contrast, self-hosted deployments require organizations to manage everything themselves, from detection to remediation.”
The incident also serves as a stark reminder of how critical vulnerabilities can quickly escalate into national security threats when exploited by state-sponsored actors. With evidence of advanced persistent threat (APT) campaigns already in play, the need for prompt action has never been clearer.
