CVE-2026-1731
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
Description
CVE-2026-1731 is a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA). With a maximum-tier CVSS v3.1 base score of 9.8, this vulnerability allows an unauthenticated remote attacker to execute operating system commands in the context of the site user by sending specially crafted requests to the application. The flaw requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable from the network. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 16, 2026, and critically, the ransomware association is classified as Known, indicating that ransomware operators have actively leveraged this vulnerability. The EPSS score of 61.83% at the 98th percentile reflects extremely high exploitation probability, placing it among the most actively targeted vulnerabilities currently tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| beyondtrust | privileged remote access | < 25.1 |
| beyondtrust | remote support | < 25.3.2 |
References
- https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293(Permissions Required)
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-02(Vendor Advisory)
- https://github.com/win3zz/CVE-2026-1731(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731(US Government Resource)
- https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731(Third Party Advisory)
Weakness Type
CWE-78: OS Command Injection
CVE-2026-1731 is classified under CWE-78 (OS Command Injection). This weakness occurs when software constructs operating system commands using externally supplied input without proper neutralization of special elements that could alter the intended command. In the case of BeyondTrust RS and PRA, the application accepts user-supplied input through its web interface and passes it to an OS command execution function without adequate sanitization or validation. An attacker can inject shell metacharacters or additional commands into the input, causing the server to execute arbitrary operating system commands with the privileges of the application's service account. OS command injection is among the most critical vulnerability classes because it provides direct access to the underlying operating system, bypassing all application-level security controls.
Impact Analysis
The impact of CVE-2026-1731 is catastrophic, reflected in its near-maximum CVSS score of 9.8. Confidentiality is fully compromised because the attacker gains the ability to execute arbitrary operating system commands, enabling complete data exfiltration from the server. This includes access to configuration files containing credentials, session tokens for active remote support sessions, stored connection profiles, and any sensitive data transiting through the remote access platform. Given that BeyondTrust RS and PRA are specifically designed to provide privileged access to critical systems, the compromised server likely holds credentials and session data for high-value targets across the organization.
Integrity suffers maximum impact as the attacker can modify any file accessible to the service account, alter application configurations, plant backdoors, manipulate audit logs to cover their tracks, and potentially pivot to connected systems using stored credentials. The attacker could also modify the BeyondTrust application itself to intercept future remote support sessions or inject malicious payloads into sessions between support technicians and end users.
Availability is equally at risk. The attacker can terminate services, corrupt data, deploy ransomware, or use the compromised server as a launching point for denial-of-service attacks against internal systems. The known ransomware association makes availability impact particularly concerning, as ransomware operators have specifically targeted this vulnerability to encrypt systems and demand payment. The attack requires no privileges (PR:N), no user interaction (UI:N), and has low complexity (AC:L), meaning any attacker with network access to the BeyondTrust instance can exploit it immediately.
Exploit Maturity
CVE-2026-1731 has reached the highest level of exploit maturity. CISA has confirmed active exploitation by adding it to the KEV catalog with a remediation deadline of February 16, 2026, and has classified the ransomware association as Known, meaning ransomware operators are actively using this vulnerability in their attack campaigns. The EPSS score of 61.83% at the 98th percentile is among the highest observed, indicating massive exploitation activity across the internet. A public exploit and detailed analysis are available on GitHub (CVE-2026-1731 by win3zz), providing step-by-step reproduction instructions that further lower the barrier to exploitation. GreyNoise has published reconnaissance observations documenting widespread scanning activity targeting BeyondTrust instances (GreyNoise analysis), confirming that threat actors are actively probing internet-facing systems for this vulnerability. The combination of pre-authentication exploitation, trivial complexity, public exploit code, and confirmed ransomware usage makes this one of the most dangerous vulnerabilities currently in active circulation.
Remediation
-
Patch immediately by upgrading BeyondTrust Remote Support to version 25.3.2 or later, and BeyondTrust Privileged Remote Access to version 25.1 or later. The vendor advisory (BT26-02) provides detailed upgrade instructions and affected version information. Given the confirmed ransomware exploitation, this patch must be treated as an absolute emergency with zero tolerance for delay.
-
Restrict network access to the BeyondTrust web interface immediately as a compensating control while patches are deployed. Use firewall rules to block all internet-facing access to the application and limit access to trusted internal networks only. If the application must be internet-accessible, implement IP allowlisting for known legitimate source addresses.
-
Conduct a thorough compromise assessment before and after patching. Review web server logs, application logs, and system logs for indicators of exploitation, including unusual command execution, unexpected process creation, unauthorized file modifications, and outbound connections to unknown destinations. Given the ransomware association, specifically check for encryption activity, ransom notes, and lateral movement patterns.
-
Rotate all credentials stored on or accessible through the BeyondTrust platform after patching. This includes local service accounts, stored connection credentials, API keys, database passwords, and any credentials that were used in remote support sessions during the exposure window. Assume all credentials on the compromised system are leaked.
-
Review all remote support session logs for the exposure period to identify any sessions that may have been intercepted, recorded, or manipulated by an attacker. Notify affected users and downstream systems if session compromise is suspected.
-
Implement network monitoring for outbound connections from the BeyondTrust server to detect command-and-control communication or data exfiltration that may indicate an ongoing compromise.
Technical Details
CVE-2026-1731 is a pre-authentication OS command injection vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), described by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in the request processing logic of the web-based interface, where user-supplied input from specially crafted HTTP requests is incorporated into operating system commands without proper sanitization.
The pre-authentication nature of this vulnerability is particularly significant. The vulnerable code path is reachable before any authentication checks are performed, meaning an attacker does not need valid credentials, session tokens, or any form of prior access. Simply sending a crafted HTTP request to the target server is sufficient to achieve command execution. The commands execute in the context of the site user, which is the operating system account under which the BeyondTrust application runs, typically carrying elevated privileges necessary for the application's remote access functionality.
BeyondTrust Remote Support versions prior to 25.3.2 and Privileged Remote Access versions prior to 25.1 are confirmed affected. The fix in the patched versions introduces proper input validation and sanitization that prevents shell metacharacters and injected commands from reaching the OS command execution layer. The vendor advisory emphasizes that this vulnerability affects both the RS and PRA product lines, and organizations running either product must verify their version and apply the appropriate update.
The attack surface is particularly dangerous because BeyondTrust RS and PRA are remote access solutions frequently deployed with internet-facing interfaces to enable external support technicians and privileged users to connect. This internet exposure, combined with pre-authentication exploitation, creates a direct path from the internet to arbitrary command execution on the server hosting the remote access platform.
Frequently Asked Questions
What is CVE-2026-1731?
CVE-2026-1731 is a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). It allows unauthenticated attackers to execute arbitrary operating system commands on the server by sending specially crafted HTTP requests.
Is CVE-2026-1731 being used in ransomware attacks?
Yes. CISA has classified the ransomware association as Known, confirming that ransomware operators are actively exploiting this vulnerability. Organizations should treat patching as an immediate emergency.
Which BeyondTrust versions are affected by CVE-2026-1731?
BeyondTrust Remote Support versions prior to 25.3.2 and Privileged Remote Access versions prior to 25.1 are affected. Organizations should upgrade to these versions or later immediately.
Does CVE-2026-1731 require authentication to exploit?
No. This is a pre-authentication vulnerability, meaning an attacker needs no credentials, session tokens, or prior access. Any attacker with network access to the BeyondTrust web interface can exploit it.
How can I tell if my BeyondTrust system has been compromised via CVE-2026-1731?
Review web server and application logs for unusual HTTP requests, check system logs for unexpected command execution or process creation, look for unauthorized file modifications, and monitor for outbound connections to unknown destinations. GreyNoise has published indicators of scanning activity that can help identify reconnaissance targeting your systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.