> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Critical Pre-Auth RCE Vulnerability in BeyondTrust Remote Support & PRA Exposes Thousands of Instances (CVE-2026-1731) - URL: https://darkwebinformer.com/critical-pre-auth-rce-vulnerability-in-beyondtrust-remote-support-pra-allegedly-exposes-thousands-of-instances-cve-2026-1731/ - Published: 2026-02-10T17:07:47.000Z - Updated: 2026-02-10T17:54:50.000Z - Author: Dark Web Informer - Tags: Vulnerabilities # Critical Pre-Auth RCE Vulnerability in BeyondTrust Remote Support & PRA Exposes Thousands of Instances (CVE-2026-1731) February 10, 2026 • Dark Web Informer • Vulnerability Intelligence ⚠ CVSS 9.9 — Critical CVE CVE-2026-1731 CWE CWE-78 Type OS Command Injection Auth None (Pre-Auth) ## Vulnerability Overview BeyondTrust has disclosed a critical pre-authentication remote code execution vulnerability affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw, tracked as **CVE-2026-1731**, carries a near-maximum **CVSS score of 9.9** and could allow an unauthenticated remote attacker to execute arbitrary operating system commands without any authentication or user interaction — making it trivially exploitable in the right conditions. The vulnerability was identified by security researcher **Harsh Jaiswal** and the **Hacktron AI** team through AI-enabled variant analysis and was responsibly disclosed to BeyondTrust. According to the researchers, roughly **11,000 BeyondTrust Remote Support instances** are currently exposed to the internet, with approximately 8,500 of those being on-premises deployments that remain potentially vulnerable if patches haven't been applied. This is particularly concerning given BeyondTrust's massive enterprise footprint — the company provides identity security services to more than 20,000 customers across over 100 countries, including 75% of the Fortune 100\. Remote Support and Privileged Remote Access are widely deployed for IT helpdesk operations and privileged session management in enterprise environments, meaning the potential blast radius of this vulnerability is significant. ## Technical Details CVE-2026-1731 is classified under **CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)**. The vulnerability exists because the application fails to properly sanitize input in specially crafted client requests, allowing an attacker to inject and execute operating system commands in the context of the site user. Attack Vector Network (Remote) Authentication None Required User Interaction None CVSS Score 9.9 — Critical CWE CWE-78 Impact Full System Compromise Full technical details of the exploitation method have been withheld to give organizations time to apply patches. ## Affected Versions | Product | Affected Versions | Fixed Version | | ------------------------------ | ----------------- | --------------------------- | | Remote Support (RS) | 25.3.1 and prior | 25.3.2+ / Patch BT26-02-RS | | Privileged Remote Access (PRA) | 24.3.4 and prior | 25.1.1+ / Patch BT26-02-PRA | **Note:** Customers running Remote Support versions older than 21.3 or Privileged Remote Access versions older than 22.1 must first upgrade to a supported version before applying the security patch. ## Patch & Remediation Status ● SaaS Customers Automatically Patched BeyondTrust applied patches to all Remote Support SaaS and Privileged Remote Access SaaS instances on **February 2, 2026**. No action required. ● Self-Hosted Customers Manual Patch Required Apply patch **BT26-02-RS** (Remote Support) or **BT26-02-PRA** (Privileged Remote Access) through the `/appliance` interface if automatic updates are not enabled. ## Historical Context: BeyondTrust as a High-Value Target While BeyondTrust has confirmed there is **no known active exploitation** of CVE-2026-1731 at this time, the platform has a documented history of being targeted by sophisticated threat actors. Late 2024 Chinese state-sponsored group **Silk Typhoon** exploited two zero-day vulnerabilities (CVE-2024-12356 and CVE-2024-12686) in BeyondTrust RS/PRA, leading to the breach of the **U.S. Treasury Department** and access to sensitive sanctions-related data. CISA issued emergency directives. Early 2025 Rapid7 research revealed CVE-2024-12356 exploitation required chaining with a then-unknown SQL injection vulnerability in PostgreSQL (CVE-2025-1094), highlighting the complexity and determination of the threat actors involved. June 2025 BeyondTrust patched a high-severity Server-Side Template Injection vulnerability in RS/PRA that could have allowed unauthenticated attackers to achieve remote code execution. February 2026 **CVE-2026-1731** disclosed — a critical pre-auth RCE via OS command injection, discovered through AI-enabled variant analysis by Hacktron AI. **Important:** Given this pattern of nation-state interest in BeyondTrust products, organizations should treat CVE-2026-1731 as a high-priority remediation target regardless of current exploitation status. ## Exposure Analysis According to Hacktron AI's scanning via Shodan and FOFA: \~11,000 Total Instances Exposed \~8,500 On-Prem (At Risk) \~2,500 SaaS (Auto-Patched) ## Recommendations 1. **Patch immediately.** Self-hosted customers should apply BT26-02-RS or BT26-02-PRA without delay. 2. **Verify patch status.** Confirm that automatic updates are enabled or that the patch has been successfully applied through the `/appliance` interface. 3. **Audit access logs.** Review BeyondTrust RS/PRA logs for unusual or unauthorized access patterns, particularly unauthenticated requests. 4. **Restrict network exposure.** Limit internet-facing access to BeyondTrust instances where possible. Place behind VPN or restrict to known IP ranges. 5. **Monitor for IOCs.** Watch for updates from BeyondTrust, CISA, and threat intelligence providers regarding any indicators of compromise. ## References - [BeyondTrust Security Advisory BT26-02](https://www.beyondtrust.com/trust-center/security-advisories/bt26-02) - [Hacktron AI — CVE-2026-1731 Disclosure](https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce) - [NVD — CVE-2026-1731](https://nvd.nist.gov/vuln/detail/CVE-2026-1731) - [Rapid7 — Emerging Threat Response: CVE-2026-1731](https://www.rapid7.com/blog/post/etr-cve-2026-1731-critical-unauthenticated-remote-code-execution-rce-beyondtrust-remote-support-rs-privileged-remote-access-pra/)