Skip to content
Support
Sign In Subscribe
Vulnerabilities

Critical Pre-Auth RCE Vulnerability in BeyondTrust Remote Support & PRA Exposes Thousands of Instances (CVE-2026-1731)

,   and  Dark Web Informer
8 min read

Critical Pre-Auth RCE Vulnerability in BeyondTrust Remote Support & PRA Exposes Thousands of Instances (CVE-2026-1731)

February 10, 2026 • Dark Web Informer • Vulnerability Intelligence
⚠ CVSS 9.9 — Critical
CVE CVE-2026-1731 CWE CWE-78 Type OS Command Injection Auth None (Pre-Auth)

Vulnerability Overview

BeyondTrust has disclosed a critical pre-authentication remote code execution vulnerability affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw, tracked as CVE-2026-1731, carries a near-maximum CVSS score of 9.9 and could allow an unauthenticated remote attacker to execute arbitrary operating system commands without any authentication or user interaction — making it trivially exploitable in the right conditions.

The vulnerability was identified by security researcher Harsh Jaiswal and the Hacktron AI team through AI-enabled variant analysis and was responsibly disclosed to BeyondTrust. According to the researchers, roughly 11,000 BeyondTrust Remote Support instances are currently exposed to the internet, with approximately 8,500 of those being on-premises deployments that remain potentially vulnerable if patches haven't been applied.

This is particularly concerning given BeyondTrust's massive enterprise footprint — the company provides identity security services to more than 20,000 customers across over 100 countries, including 75% of the Fortune 100. Remote Support and Privileged Remote Access are widely deployed for IT helpdesk operations and privileged session management in enterprise environments, meaning the potential blast radius of this vulnerability is significant.

Technical Details

CVE-2026-1731 is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). The vulnerability exists because the application fails to properly sanitize input in specially crafted client requests, allowing an attacker to inject and execute operating system commands in the context of the site user.

Attack Vector
Network (Remote)
Authentication
None Required
User Interaction
None
CVSS Score
9.9 — Critical
CWE
CWE-78
Impact
Full System Compromise

Full technical details of the exploitation method have been withheld to give organizations time to apply patches.

Affected Versions

Product Affected Versions Fixed Version
Remote Support (RS) 25.3.1 and prior 25.3.2+ / Patch BT26-02-RS
Privileged Remote Access (PRA) 24.3.4 and prior 25.1.1+ / Patch BT26-02-PRA
Note: Customers running Remote Support versions older than 21.3 or Privileged Remote Access versions older than 22.1 must first upgrade to a supported version before applying the security patch.

Patch & Remediation Status

● SaaS Customers
Automatically Patched
BeyondTrust applied patches to all Remote Support SaaS and Privileged Remote Access SaaS instances on February 2, 2026. No action required.
● Self-Hosted Customers
Manual Patch Required
Apply patch BT26-02-RS (Remote Support) or BT26-02-PRA (Privileged Remote Access) through the /appliance interface if automatic updates are not enabled.

Historical Context: BeyondTrust as a High-Value Target

While BeyondTrust has confirmed there is no known active exploitation of CVE-2026-1731 at this time, the platform has a documented history of being targeted by sophisticated threat actors.

Late 2024
Chinese state-sponsored group Silk Typhoon exploited two zero-day vulnerabilities (CVE-2024-12356 and CVE-2024-12686) in BeyondTrust RS/PRA, leading to the breach of the U.S. Treasury Department and access to sensitive sanctions-related data. CISA issued emergency directives.
Early 2025
Rapid7 research revealed CVE-2024-12356 exploitation required chaining with a then-unknown SQL injection vulnerability in PostgreSQL (CVE-2025-1094), highlighting the complexity and determination of the threat actors involved.
June 2025
BeyondTrust patched a high-severity Server-Side Template Injection vulnerability in RS/PRA that could have allowed unauthenticated attackers to achieve remote code execution.
February 2026
CVE-2026-1731 disclosed — a critical pre-auth RCE via OS command injection, discovered through AI-enabled variant analysis by Hacktron AI.
Important: Given this pattern of nation-state interest in BeyondTrust products, organizations should treat CVE-2026-1731 as a high-priority remediation target regardless of current exploitation status.

Exposure Analysis

According to Hacktron AI's scanning via Shodan and FOFA:

~11,000
Total Instances Exposed
~8,500
On-Prem (At Risk)
~2,500
SaaS (Auto-Patched)

Recommendations

  1. Patch immediately. Self-hosted customers should apply BT26-02-RS or BT26-02-PRA without delay.
  2. Verify patch status. Confirm that automatic updates are enabled or that the patch has been successfully applied through the /appliance interface.
  3. Audit access logs. Review BeyondTrust RS/PRA logs for unusual or unauthorized access patterns, particularly unauthenticated requests.
  4. Restrict network exposure. Limit internet-facing access to BeyondTrust instances where possible. Place behind VPN or restrict to known IP ranges.
  5. Monitor for IOCs. Watch for updates from BeyondTrust, CISA, and threat intelligence providers regarding any indicators of compromise.

References

Comments

Related

Latest