Critical Vulnerability in BeyondTrust Remote Support Exposes Healthcare Systems

In June 2025, BeyondTrust, a leading provider of privileged access management solutions, released a security advisory highlighting a critical vulnerability in its Remote Support and Privileged Remote Access products. This flaw, designated as CVE-2025-5309, has a CVSSv4 base score of 8.6, indicating its severity. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code within the context of the server, posing significant risks to system integrity and data confidentiality. (digital.nhs.uk)

Vulnerability Details

The vulnerability resides in the chat feature of BeyondTrust’s Remote Support and Privileged Remote Access tools. Due to improper control over the generation of code, an attacker could inject malicious code, leading to remote code execution. This issue affects versions 24.2.2 to 25.1.1 of both products. (digital.nhs.uk)

Impact on Healthcare Organizations

Are outdated storage systems putting your patient data at risk? Learn about TrueNASs robust security.

Healthcare institutions, which often rely on BeyondTrust’s solutions for secure remote access, are particularly vulnerable. The exploitation of this flaw could grant unauthorized individuals access to sensitive patient data and critical medical systems. For instance, a breach could compromise electronic health records (EHRs), leading to potential data theft or manipulation. Such incidents not only jeopardize patient privacy but also undermine trust in healthcare providers.

Historical Context

This isn’t the first time BeyondTrust has faced security challenges. In December 2024, the company identified and patched two significant vulnerabilities in its Remote Support and Privileged Remote Access products. CVE-2024-12356, with a CVSSv3 score of 9.8, allowed unauthenticated attackers to execute underlying operating system commands within the context of the site user. CVE-2024-12686, rated 6.6, permitted attackers with existing administrative privileges to inject commands in the context of a site user. (digital.nhs.uk)

Recommendations for Healthcare Organizations

Given the critical nature of this vulnerability, healthcare organizations are strongly advised to:

• Review the Security Advisory: Examine BeyondTrust’s official advisory BT25-04 for detailed information on the vulnerability and its implications.

• Apply Patches Promptly: Ensure that all affected systems are updated to the latest versions to mitigate potential risks.

• Monitor Systems Vigilantly: Implement enhanced monitoring to detect any unusual activities that might indicate exploitation attempts.

• Educate Staff: Conduct training sessions to raise awareness about potential phishing attempts or other social engineering tactics that could exploit this vulnerability.

Conclusion

The discovery of CVE-2025-5309 underscores the ongoing challenges in maintaining secure remote access solutions, especially within the healthcare sector. While BeyondTrust has acted swiftly to address the issue, the onus is on healthcare organizations to implement the recommended measures to safeguard their systems and, most importantly, their patients.

References

• BeyondTrust Releases Security Advisory for Remote Support & Privileged Remote Access – NHS England Digital (digital.nhs.uk)

• BeyondTrust Releases Security Advisory for Remote Support & Privileged Remote Access – NHS England Digital (digital.nhs.uk)

• Warning: Remote Code Execution In BeyondTrust Remote Support and Privileged Remote Access, Patch Immediately! | CCB Safeonweb (ccb.belgium.be)

• January 2 Advisory: Actively Exploited Vulnerability in BeyondTrust Products [CVE-2024-12356] | Censys (censys.com)

• BeyondTrust Remote Support (RS) <= 24.3.1 Multiple Vulnerabilities | Tenable® (tenable.com)

• BeyondTrust Patches Critical Vulnerability Discovered During Security Incident Probe – SecurityWeek (securityweek.com)

• BeyondTrust Remote Support SaaS Service Security Investigation | BeyondTrust (beyondtrust.com)

• BeyondTrust RemoteView | Medtronic (global.medtronic.com)

• Maintaining Secure Access at All Times with Bomgar | BeyondTrust (beyondtrust.com)

• BeyondTrust says hackers breached Remote Support SaaS instances | BleepingComputer (bleepingcomputer.com)