What’s Vulnerable › Vulnerabilities

CVE-2026-1731: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-02-13
• EPSS: 93.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-06 · updated 2026-06-17
• Weakness: CWE-78

Description

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Affected products

• BeyondTrust Privileged Remote Access: before 25.1 — fixed in 25.1
• BeyondTrust Remote Support: before 25.3.2 — fixed in 25.3.2

How to fix

Upgrade to a fixed version: BeyondTrust Privileged Remote Access 25.1; BeyondTrust Remote Support 25.3.2. Check the vendor advisory for mitigations.

In the news

• CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

References

• https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293
• https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
• https://github.com/win3zz/CVE-2026-1731
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731
• https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731

Get alerted when CVE-2026-1731 or the next vulnerability affects your stack