CVE-2026-1731
Published: February 13, 2026
Official Description
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
CISA KEV Advisory
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) contain a critical OS command injection vulnerability that allows an unauthenticated remote attacker to execute operating system commands. With a CVSS score of 9.8 and an EPSS score of 0.61831, along with its presence in the KEV catalog, this vulnerability poses an extremely urgent and confirmed risk of system compromise.
This vulnerability is actively being exploited in the wild. It is remotely exploitable without authentication or user interaction, leading to potential system compromise.
Immediately apply the latest security patches and updates for BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). Review system logs for any signs of unauthorized command execution.
Technical Analysis
CVE-2026-1731 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CISA has added CVE-2026-1731 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
News & Research Mentioning CVE-2026-1731
Hackers are actively exploiting the CVE-2026-1731 vulnerability in the BeyondTrust Remote Support product, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns. [...] [xlite_meta score:64 src:BleepingComputer xlite_fp:b56872308b14c19d6d99fe51dd14c56b2d088a7b93a49ce7a06b5fe3a7f877f3]
Threat actors have been observed exploiting a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to conduct a wide range of malicious actions, including deploying VShell and The vulnerability, tracked as CVE-2026-1731 (CVSS score: 9.9), allows attackers to execute operating system commands in the context of the [xlite_meta score:50 src:The Hacker News xlite_fp:246dc840cbcd16e675773ddfaa7542622e34dc0cc2fb85ba6c1289f872aaa1b9]
CISA has updated its KEV entry for CVE-2026-1731 to alert organizations of exploitation in ransomware attacks. The post BeyondTrust Vulnerability Exploited in Ransomware Attacks appeared first on SecurityWeek. [xlite_meta score:56 src:SecurityWeek xlite_fp:ab22c0759ef972db1f4d028c203b7b4021c39b28b825f002b2f0c99187b42e51]
CVE-2026-1731 is an RCE vulnerability in identity platform BeyondTrust. This flaw allows attackers control of systems without login credentials. The post VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) appeared first on Unit 42. [xlite_meta score:50 src:Palo Alto Unit 42 xlite_fp:3c0eaa4d4ca6688da6fe913d23d1ff077f54d8c12d58782f480110cf782ee0d5]
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-1731 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities b [xlite_meta score:38 src:CISA Alerts xlite_fp:37acdc36b234dfc73e4a6027db41266a72edca53be246de93751a188f010f6b7]
All References (1)
Quick Facts
Known Threat Actors
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-1731 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1