Remote Code Execution Vulnerability in BeyondTrust Remote Support and Privileged Remote Access
CVE-2026-1731

9.9CRITICAL

Key Information:

Vendor

Beyondtrust

Status
Remote Support(rs) & Privileged Remote Access(pra)
Vendor
CVE Published:
6 February 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 12,400💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 61%🦅 CISA Reported

What is CVE-2026-1731?

CVE-2026-1731 is a critical vulnerability affecting BeyondTrust's Remote Support and certain legacy versions of Privileged Remote Access software. This vulnerability allows for remote code execution prior to authentication, which means that an unauthenticated attacker could send specially crafted requests to execute operating system commands within the context of the user session. Given that BeyondTrust solutions are often employed for managing remote support tasks and privileged access, an exploit of this nature can severely compromise the integrity and security of an organization’s systems, potentially leading to unauthorized access to sensitive information and control over critical infrastructure.

Potential impact of CVE-2026-1731

  1. Unauthorized System Access: The vulnerability enables attackers to execute commands without needing authentication, allowing them to bypass security measures and gain unauthorized access to affected systems.

  2. Data Breach Risks: Exploitation of this vulnerability can lead to the exposure of sensitive organizational data, putting both proprietary information and customer data at risk.

  3. Operational Disruption: An attacker leveraging this vulnerability can potentially gain control over key functionalities within the BeyondTrust platform, leading to service interruptions, operational disruptions, or the deployment of additional malicious activities within the organization’s network.

CISA has reported CVE-2026-1731

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-1731 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Remote Support(RS) & Privileged Remote Access(PRA) 0

Remote Support(RS) & Privileged Remote Access(PRA) 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-1731
Created by win3zz

CVE-2026-1731
Created by jakubie07

cve-2026-1731-scanner
Created by cybrdude

References

https://beyondtrustcorp.service-now.com/csm?id=csm_kb_art...
https://www.beyondtrust.com/trust-center/security-advisor...

EPSS Score

61% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 💰

    Used in Ransomware

  • 🦅

    CISA Reported

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 🥇

    Vulnerability reached the number 1 worldwide trending spot

  • 📈

    Vulnerability started trending

  • Vulnerability published

  • Vulnerability Reserved

JSON
.