BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-12356 | Unauthenticated Command Injection in BeyondTrust Privileged Remote Access/Remote Support BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an unauthenticated command injection flaw (CWE-77) that allows a remote attacker to inject commands that are executed as a site user. The vulnerability is network-facing with low attack complexity and requires no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), so any attacker who can reach the affected PRA/RS interface can trigger it. Successful exploitation yields arbitrary command execution in the context of the site user, with high impact ratings for confidentiality, integrity, and availability. Any organization running BeyondTrust PRA or RS — particularly where those remote-access/remote-support services are exposed to the internet — is affected; the available data does not specify affected version ranges. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-19, carries an 88% EPSS probability of exploitation within 30 days (100th percentile), and was reportedly used in the breach of the U.S. Treasury alongside a PostgreSQL vulnerability. Do: Apply BeyondTrust's patches or vendor-specified mitigations immediately — remediation is mandatory for U.S. federal agencies under the KEV listing, and the source data does not include fixed build numbers, so confirm the correct upgrade version in BeyondTrust's security bulletin. As an interim measure, restrict or remove internet exposure of PRA/RS endpoints and hunt for signs of exploitation (unexpected commands executed as the site user), noting this flaw was used in the U.S. Treasury intrusion. If mitigations are unavailable, CISA's required action is to discontinue use of the product. | 9.8 | 88% | KEV PoC |
| moderate≈ a few thousand internet-exposed PRA/RS instances (order-of-magnitude estimate from public internet scans) | |
| CVE-2026-1731 | Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical (CVSS 4.0: 9.9) pre-authentication operating system command injection vulnerability (CWE-78). By sending specially crafted requests to the appliance, an unauthenticated remote attacker can execute operating system commands in the context of the site user, gaining code execution without credentials or user interaction. Any organization running RS or PRA appliances that are reachable from the internet, which is their typical deployment mode for remote support and privileged access, is affected. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-13 with known ransomware use, carries an EPSS of 89.5% (100th percentile), has a public proof-of-concept, and press coverage links the newly patched BeyondTrust RCE to fast-moving ransomware activity (Storm-1175). BeyondTrust has released fixes, so unpatched, internet-exposed instances should be treated as high-priority compromise targets. Do: Upgrade all internet-exposed Remote Support and Privileged Remote Access appliances to the fixed releases in BeyondTrust's security advisory immediately, per the CISA KEV required action (apply vendor mitigations or discontinue use if mitigation is unavailable). Until patched, restrict network access to the appliance and review appliance/web logs for suspicious unauthenticated requests, given known ransomware exploitation and the availability of a public proof-of-concept. | 9.9 | 90% | KEV ransomware PoC |
| largeon the order of tens of thousands of internet-exposed RS/PRA appliance instances worldwide |
Full article585 words · extracted from helpnetsecurity.com · click to collapse
BeyondTrust fixed a critical remote code execution vulnerability (CVE-2026-1731) in its Remote Support (RS) and Privileged Remote Access (PRA) solutions and is urging self-hosted customers to apply the patch as soon a possible.
Unlike the Remote Support zero-day (CVE-2024-12356) that was flagged after having been exploited by China-nexus threat actors to breach the US Treasury Department in late 2024, this newest vulnerability was discovered and privately disclosed by a security researcher.
About CVE-2026-1731
BeyondTrust Privileged Remote Access is a remote help/remote access tool for IT and support teams to troubleshoot and fix problems on enterprise endpoints.
BeyondTrust Privileged Remote Access (PRA) is a product designed to provide privileged users (IT admins, third-party vendors, etc.) secure, controlled, and audited access to internal systems.
Organizations can deploy both solutions either on-premises or in the cloud, including via software-as-a-service (SaaS) models.
CVE-2026-1731 is caused by improper neutralization of special elements used in an OS command. It can be triggered by unauthenticated remote attackers sending a specially crafted client request to a vulnerable BeyondTrust RS or PRA instance.
“Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user,” BeyondTrust says.
“Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.”
What to do?
CVE-2026-1731 affects Remote Support versions 25.3.1 and prior and Privileged Remote Access versions 24.3.4 and prior.
BeyondTrust has applied the patch for its Remote Support SaaS and Privileged Remote Access SaaS customers on February 2, 2026, and is now urging self-hosted customers to either apply the patch and/or upgrade to a fixed version.
“Customers on a Remote Support version older than 21.3 or on Privileged Remote Access older than 22.1 will need to upgrade to a newer version to apply this patch,” the company added.
While there is no indication that CVE-2026-1731 is being leveraged by attackers, skilled attackers may quickly reverse-engineer the patch, pinpont the vulnerability, and devise an exploit.
The flaw was reported by Harsh Jaiswal and the Hacktron AI team, who pointed out that there are around 8,500 internet-facing on-prem Remote Support deployments out there that may be vulnerable if patches aren’t applied.
“At this time, we are withholding technical details to allow affected parties sufficient time to apply patches. We strongly recommend addressing this vulnerability promptly, as exploitation is straightforward,” they added.
UPDATE (February 12, 2026, 05:10 a.m. ET):
Rapid7 has analyzed the patch for CVE-2026-1731 and released a proof-of-concept (PoC) exploit.
UPDATE (February 13, 2026, 03:40 p.m. ET):
Several companies have reported in-the-wild exploitation of the vulnerability.
UPDATE (February 20, 2026, 10:05 a.m. ET):
CVE-2026-1731 is being leveraged in ransomware campaigns.
The US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaw to its Known Exploited Vulnerabilities catalog on February 13, updated the entry yesterday to confirm this activity.
Palo Alto Networks’ Unit 42 is actively investigating multiple compromises related to the exploitation of CVE-2026-1731 and says that the attackers are set on data theft.
“The attackers targeted configuration files, internal system databases and a full PostgreSQL dump, attempting to transmit data to an attacker-controlled C2 server,” the company shared on Thursday.
Victim organizations span multiple sectors, including financial services, healthcare, education, technology, legal, and retail. They are also spread across North America (both the US and Canada), France, Germany, and Australia.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/02/09/beyondtrust-remote-access-vulnerability-cve-2026-1731/