Vulnerability details
CVE-2026-1731
Actively exploited
BeyondTrust Remote Support & Privileged Remote Access
Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
CVSS 4.0
9.9Critical
Official description
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.9Critical | 4.0 | CVEProject cvelistV5 (CNA) (BT) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| BeyondTrust | Remote Support(RS) & Privileged Remote Access(PRA) | v ≤ RS 25.3.1 | CVEProject cvelistV5 (CNA) |
| BeyondTrust | Remote Support(RS) & Privileged Remote Access(PRA) | v ≤ PRA 24.3.4 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
- https://github.com/win3zz/CVE-2026-1731 exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731 government-resource
- https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731 third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-07
- Last updated
- 2026-02-26
- State
- Published
- Assigner (CNA)
- BT
- Kolun priority
- 90 · Critical
CISA KEV catalog
- Date added
- 2026-02-13
- Due date
- 2026-02-16
- Used in ransomware
- Yes
Exploit prediction (EPSS)
93.85%
Probability of exploitation in 30 days
99.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')