Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-43468 | Unauthenticated SQL Injection to RCE in Microsoft Configuration Manager | 9.8 | 81% | KEV | KEV |
| CVE-2025-15556 | Unverified updates in Notepad++ WinGUp updater allow arbitrary code execution | 7.7 | 2% | KEV | KEV |
| CVE-2025-26399 | Unauthenticated Deserialization RCE in SolarWinds Web Help Desk | 9.8 | 90% | KEVRansomware | KEV |
CVE-2025-40551+1 related CVE | Unauthenticated Deserialization RCE in SolarWinds Web Help Desk | 9.8 | 84% | KEV | KEV |
| CVE-2026-1731 | Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA | 9.9 | 93% | KEVRansomwarePoC | KEV |
| CVE-2026-20700 | Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 | 2% | KEV | KEV |
From the original article
5 min read at thehackernews.com
Threat actors have started to exploit a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products, according to watchTowr. "Overnight we observed first in-the-wild exploitation of BeyondTrust across our global sensors," Ryan Dewhurst, head of threat intelligence at watchTowr, said in a post on X.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.