CVE-2026-1731

What it actually does

This is a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and older BeyondTrust Privileged Remote Access (PRA) deployments. A remote unauthenticated attacker can send specially crafted network requests to the exposed appliance or service and cause operating system commands to execute as the BeyondTrust site user. Because exploitation requires no credentials, no user interaction, and low complexity over the network, successful compromise can provide an attacker with direct command execution on a privileged remote-access platform that often has connectivity into sensitive internal systems.

Why it matters to the business

Compromise of a BeyondTrust RS or PRA deployment can give attackers control over a remote-support or privileged-access gateway, creating a high-risk path to internal systems, administrator sessions, credentials, and operational disruption. The vulnerability is listed in CISA KEV, is reported as actively exploited in the wild, has a high EPSS score, and is associated with ransomware use, so exposed systems should be treated as urgent remediation priorities. Organizations that rely on BeyondTrust for help desk, vendor access, or privileged remote administration may face outage risk, lateral movement, data theft, ransomware deployment, and loss of trust in remote-access workflows.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable BeyondTrust Remote Support or vulnerable Privileged Remote Access instance. Because the flaw is pre-authentication, the attacker does not need a valid user account or an active support session. The attacker then sends crafted requests to the vulnerable service that trigger command injection or command execution in the context of the BeyondTrust site user. After initial code execution, the attacker may run reconnaissance commands, download tools, establish persistence, access application data or credentials, pivot through remote-access capabilities, and use the compromised appliance as a foothold for broader intrusion. Given the KEV listing, active exploitation, and ransomware association, exploitation should be assumed to be feasible and operationalized by real-world threat actors.

How to fix it

Upgrade BeyondTrust Remote Support and affected older BeyondTrust Privileged Remote Access deployments to vendor-fixed releases as soon as available and applicable. Because no exact fixed versions were provided in the input, administrators should consult the official BeyondTrust security advisory for CVE-2026-1731 and apply the recommended patched version for each deployed product line. If immediate patching is not possible, restrict access to the BeyondTrust appliance or service to trusted networks and VPNs only, block direct internet exposure, enforce allowlisting at firewalls and reverse proxies, monitor and rate-limit suspicious requests, and consider temporarily disabling externally reachable access until patched. Rotate credentials, API tokens, integration secrets, and privileged account passwords that may have been accessible from the appliance after any suspected compromise. For systems exposed before patching, perform incident-response validation rather than treating patching alone as sufficient.

How to confirm the fix worked

Confirm the deployed BeyondTrust RS or PRA version against the official vendor advisory and verify that it is at or above the fixed release for the relevant product branch. Validate that no vulnerable instances remain exposed through external attack-surface scans, vulnerability scanners, asset inventory, and firewall/reverse-proxy configuration review. Confirm that unauthenticated access paths to management or application endpoints are restricted to intended networks. After patching, review service health and confirm the application build number, package version, or appliance update status from the administrative console or supported command interface. For any instance that was internet-facing or reachable by untrusted networks before remediation, review logs and system artifacts for signs of command execution, unexpected processes, new files, outbound connections, and configuration changes.

Typical attack path

1. Scan the internet or target networks for exposed BeyondTrust Remote Support or Privileged Remote Access instances.
2. Fingerprint the service version or behavior to identify potentially vulnerable deployments.
3. Send crafted unauthenticated requests to the vulnerable service to trigger operating system command execution.
4. Execute basic reconnaissance commands to determine user context, host details, network reachability, and available tools.
5. Deploy a web shell, reverse shell, remote access tool, or other persistence mechanism if possible.
6. Harvest configuration data, logs, credentials, session artifacts, or integration secrets accessible to the site user.
7. Use the compromised remote-access platform to pivot toward internal systems, privileged sessions, or managed endpoints.
8. Exfiltrate data, disable security controls, or stage ransomware depending on attacker objectives.

How to detect it

Look for evidence of exploitation in BeyondTrust application logs, web access logs, reverse-proxy or load-balancer logs, appliance system logs, authentication and administrative audit logs, endpoint telemetry, EDR alerts, DNS logs, firewall logs, and outbound proxy records. Focus on unauthenticated requests reaching BeyondTrust RS or PRA immediately before unusual process execution, unexpected outbound connections, file writes, or administrative changes. Review HTTP requests containing command-execution patterns, shell metacharacters, encoded payloads, unusual POST bodies, anomalous user agents, or repeated probing of application endpoints. On the host or appliance, look for commands executed by the BeyondTrust site user, unexpected child processes spawned by the web/application service, newly created files in temporary or web-accessible directories, downloaded binaries, reverse-shell behavior, scheduled tasks, cron entries, new local users, altered SSH keys, and changes to BeyondTrust configuration or integrations. Because this vulnerability is actively exploited and associated with ransomware, also hunt for lateral movement from the BeyondTrust system to internal hosts, credential access, remote administration tool deployment, mass authentication failures, data staging, backup tampering, and encryption-preparation activity. Correlate any suspicious activity from the publication window onward, especially for systems that were internet-facing before patching.

What your security team should do

• Treat this as an emergency vulnerability for any internet-facing BeyondTrust RS or vulnerable PRA instance because it is KEV-listed, actively exploited, high-EPSS, and associated with ransomware campaigns.
• Immediately inventory all BeyondTrust Remote Support and Privileged Remote Access deployments, including appliances, cloud connectors, test systems, disaster-recovery systems, and externally published instances.
• Patch to the vendor-fixed release as the primary remediation; if a fixed version cannot be applied immediately, remove the service from direct internet exposure and restrict access to trusted administrative networks.
• Meet or exceed the CISA KEV remediation deadline of 2026-02-16 for covered systems; if that date has passed, prioritize remediation and incident review immediately.
• Assume exposed vulnerable systems may have been targeted and perform compromise assessment before returning them to normal operations.
• Rotate credentials, API keys, integration secrets, and privileged credentials that may be stored in or accessible through the BeyondTrust deployment.
• Review BeyondTrust administrative users, support accounts, session policies, jump items, integrations, and audit logs for unauthorized changes.
• Hunt for post-exploitation behavior such as unexpected child processes, outbound connections, tool downloads, new local users, modified startup tasks, and anomalous remote sessions.
• Increase monitoring of remote-access activity, especially connections initiated from unusual geographies, unfamiliar operators, unexpected times, or newly created accounts.
• If compromise is suspected, isolate the appliance or affected host, preserve logs and disk artifacts, engage incident response, and rebuild from trusted media or vendor-supported recovery procedures where appropriate.