widely-deployed-product-advisoryinternet-facing-service-vulnerabilityperimeter-device-exposureend-of-life-software

BeyondTrust Pre-Authentication RCE in Remote Support and Privileged Remote Access (CVE-2026-1731)

Patch & Detection Intelligence · 28 sources · Updated 4mo ago · First seen Feb 9, 2026

BeyondTrust released security updates for a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA). Tracked as CVE-2026-1731 (CVSS 9.9), the issue is described as an operating system command injection that can be triggered via specially crafted requests without authentication, allowing an attacker to execute OS commands in the context of the site user and potentially enabling unauthorized access, data exfiltration, and service disruption.

Affected versions include Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier. BeyondTrust provided fixes via RS Patch BT26-02-RS / RS 25.3.2+ and PRA Patch BT26-02-PRA / PRA 25.1.1+, and urged self-hosted customers to manually apply updates if not enrolled in automatic updates; older deployments (e.g., RS <21.3 or PRA <22.1) must first upgrade to a supported release line to apply the remediation. BeyondTrust’s SaaS instances were patched automatically (reported as completed on 2026-02-02), reducing exposure primarily to organizations operating self-managed installations.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

12 events · Feb 2, 2026 – Feb 16, 2026

Feb 16, 20269mo ago
Canadian Cyber Centre issues alert citing active exploitation
The Canadian Centre for Cyber Security released Alert AL26-003 warning that open-source reporting indicated CVE-2026-1731 was being exploited in the wild. It advised organizations to patch, review logs, restrict management interfaces, and remove internet exposure until remediation was complete.
Feb 13, 20269mo ago
CISA sets February 16 deadline for federal remediation
Under Binding Operational Directive 22-01, CISA ordered Federal Civilian Executive Branch agencies to remediate CVE-2026-1731 by February 16, 2026. The directive reflected the short timeline imposed because the flaw was already being exploited in the wild.
Feb 13, 20269mo ago
CISA adds CVE-2026-1731 to the KEV catalog
CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The agency warned that the BeyondTrust flaw posed significant risk to federal networks and urged prioritized remediation.
Feb 13, 20269mo ago
Arctic Wolf links exploitation to post-compromise intrusion activity
Arctic Wolf reported a threat campaign exploiting CVE-2026-1731 to deploy SimpleHelp for persistence, perform Active Directory discovery, create privileged accounts, and move laterally with PsExec and Impacket SMB activity. The findings showed attackers were using the flaw for broader network takeover rather than simple opportunistic access.
Feb 12, 20269mo ago
In-the-wild exploitation of CVE-2026-1731 is confirmed
watchTowr, GreyNoise, Defused Cyber, and other researchers reported active exploitation of CVE-2026-1731 against self-hosted BeyondTrust deployments. Security guidance shifted from urgent patching to assuming exposed unpatched systems may already be compromised.
Feb 12, 20269mo ago
Researchers publish technical exploitation details and detection observations
Security researchers disclosed that attackers were abusing the /get_portal_info endpoint to obtain the x-ns-company identifier and then using a WebSocket channel to execute commands. Reports from GreyNoise, Defused Cyber, Rapid7, and others also described scanning activity, Nuclei-based checks, and multiple exploit tools in use.
Feb 11, 20269mo ago
GreyNoise observes reconnaissance for vulnerable BeyondTrust systems
By February 11, GreyNoise detected active probing for vulnerable BeyondTrust RS and PRA instances following the PoC release. The scanning was heavily concentrated from a single VPN-associated IP and often targeted non-standard ports, suggesting operators understood enterprise deployment patterns.
Feb 10, 20269mo ago
Public PoC exploit for CVE-2026-1731 is posted to GitHub
A proof-of-concept exploit for CVE-2026-1731 was published online, lowering the barrier to weaponization of the newly disclosed BeyondTrust flaw. Subsequent reporting linked the release to a rapid increase in attacker interest.
Feb 9, 20269mo ago
National cyber agencies issue advisories on BeyondTrust flaw
Government cyber authorities including Canada's Cyber Centre and Belgium's CCB published alerts directing administrators to review BeyondTrust's advisory and apply updates for CVE-2026-1731. These notices amplified the vendor's warning to public- and private-sector defenders.
Feb 6, 20269mo ago
Researcher Harsh Jaiswal and Hacktron AI report the vulnerability
Harsh Jaiswal and the Hacktron AI team were identified as the discoverers who privately disclosed CVE-2026-1731 to BeyondTrust. Their analysis also estimated roughly 11,000 internet-exposed instances, including about 8,500 on-prem systems potentially vulnerable if unpatched.
Feb 6, 20269mo ago
BeyondTrust discloses CVE-2026-1731 and releases self-hosted patches
BeyondTrust published a security advisory for CVE-2026-1731, a critical pre-authentication OS command injection flaw in RS and PRA, and released patches and fixed versions for self-hosted deployments. The company warned that exploitation requires no authentication or user interaction and urged immediate patching or upgrade.
Feb 2, 20269mo ago
BeyondTrust patches SaaS RS and PRA instances for CVE-2026-1731
BeyondTrust deployed fixes for CVE-2026-1731 to its cloud-hosted Remote Support and Privileged Remote Access environments, automatically protecting SaaS customers. Self-hosted customers were not covered by this automatic remediation.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Pre-authentication OS command injection in BeyondTrust Remote Support and Privileged Remote Access (CVE-2026-1731)

Affected products

4 linked

Remote SupportPrivileged Remote AccessRemote SupportRemote Support

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

28 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · Feb 16, 2026

AL26-003 - Vulnerability affecting BeyondTrust - CVE-2026-1731 - Canadian Centre for Cyber SecurityOpen source ↗

Cyber Security NewsNews · Feb 16, 2026

Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain ControlOpen source ↗

Bleeping ComputerNews · Feb 16, 2026

CISA gives feds 3 days to patch actively exploited BeyondTrust flawOpen source ↗

Security Online InfoNews · Feb 15, 2026

Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network TakeoverOpen source ↗

20 additional sources from 09-02-2026 to 14-02-2026

Rapid7 BlogNews · Feb 9, 2026

CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)Open source ↗

Belgium Ccb Security AdvisoriesNews · Feb 9, 2026

Warning: Remote Code Execution in BeyondTrust Remote Support and Privileged Remote Access, Patch Immediately! | CCB SafeonwebOpen source ↗

Bleeping ComputerNews · Feb 9, 2026

BeyondTrust warns of critical RCE flaw in remote support softwareOpen source ↗

Help Net SecurityNews · Feb 9, 2026

BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731) - Help Net SecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

widely-deployed-product-advisoryinternet-facing-service-vulnerabilityperimeter-device-exposureend-of-life-software

BeyondTrust Pre-Authentication RCE in Remote Support and Privileged Remote Access (CVE-2026-1731)

Patch & Detection Intelligence · 28 sources · Updated 4mo ago · First seen Feb 9, 2026

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

12 events · Feb 2, 2026 – Feb 16, 2026

Feb 16, 20269mo ago
Canadian Cyber Centre issues alert citing active exploitation
The Canadian Centre for Cyber Security released Alert AL26-003 warning that open-source reporting indicated CVE-2026-1731 was being exploited in the wild. It advised organizations to patch, review logs, restrict management interfaces, and remove internet exposure until remediation was complete.
Feb 13, 20269mo ago
CISA sets February 16 deadline for federal remediation
Under Binding Operational Directive 22-01, CISA ordered Federal Civilian Executive Branch agencies to remediate CVE-2026-1731 by February 16, 2026. The directive reflected the short timeline imposed because the flaw was already being exploited in the wild.
Feb 13, 20269mo ago
CISA adds CVE-2026-1731 to the KEV catalog
CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The agency warned that the BeyondTrust flaw posed significant risk to federal networks and urged prioritized remediation.
Feb 13, 20269mo ago
Arctic Wolf links exploitation to post-compromise intrusion activity
Arctic Wolf reported a threat campaign exploiting CVE-2026-1731 to deploy SimpleHelp for persistence, perform Active Directory discovery, create privileged accounts, and move laterally with PsExec and Impacket SMB activity. The findings showed attackers were using the flaw for broader network takeover rather than simple opportunistic access.
Feb 12, 20269mo ago
In-the-wild exploitation of CVE-2026-1731 is confirmed
watchTowr, GreyNoise, Defused Cyber, and other researchers reported active exploitation of CVE-2026-1731 against self-hosted BeyondTrust deployments. Security guidance shifted from urgent patching to assuming exposed unpatched systems may already be compromised.
Feb 12, 20269mo ago
Researchers publish technical exploitation details and detection observations
Security researchers disclosed that attackers were abusing the /get_portal_info endpoint to obtain the x-ns-company identifier and then using a WebSocket channel to execute commands. Reports from GreyNoise, Defused Cyber, Rapid7, and others also described scanning activity, Nuclei-based checks, and multiple exploit tools in use.
Feb 11, 20269mo ago
GreyNoise observes reconnaissance for vulnerable BeyondTrust systems
By February 11, GreyNoise detected active probing for vulnerable BeyondTrust RS and PRA instances following the PoC release. The scanning was heavily concentrated from a single VPN-associated IP and often targeted non-standard ports, suggesting operators understood enterprise deployment patterns.
Feb 10, 20269mo ago
Public PoC exploit for CVE-2026-1731 is posted to GitHub
A proof-of-concept exploit for CVE-2026-1731 was published online, lowering the barrier to weaponization of the newly disclosed BeyondTrust flaw. Subsequent reporting linked the release to a rapid increase in attacker interest.
Feb 9, 20269mo ago
National cyber agencies issue advisories on BeyondTrust flaw
Government cyber authorities including Canada's Cyber Centre and Belgium's CCB published alerts directing administrators to review BeyondTrust's advisory and apply updates for CVE-2026-1731. These notices amplified the vendor's warning to public- and private-sector defenders.
Feb 6, 20269mo ago
Researcher Harsh Jaiswal and Hacktron AI report the vulnerability
Harsh Jaiswal and the Hacktron AI team were identified as the discoverers who privately disclosed CVE-2026-1731 to BeyondTrust. Their analysis also estimated roughly 11,000 internet-exposed instances, including about 8,500 on-prem systems potentially vulnerable if unpatched.
Feb 6, 20269mo ago
BeyondTrust discloses CVE-2026-1731 and releases self-hosted patches
BeyondTrust published a security advisory for CVE-2026-1731, a critical pre-authentication OS command injection flaw in RS and PRA, and released patches and fixed versions for self-hosted deployments. The company warned that exploitation requires no authentication or user interaction and urged immediate patching or upgrade.
Feb 2, 20269mo ago
BeyondTrust patches SaaS RS and PRA instances for CVE-2026-1731
BeyondTrust deployed fixes for CVE-2026-1731 to its cloud-hosted Remote Support and Privileged Remote Access environments, automatically protecting SaaS customers. Self-hosted customers were not covered by this automatic remediation.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Pre-authentication OS command injection in BeyondTrust Remote Support and Privileged Remote Access (CVE-2026-1731)

Affected products

4 linked

Remote SupportPrivileged Remote AccessRemote SupportRemote Support

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

28 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · Feb 16, 2026

AL26-003 - Vulnerability affecting BeyondTrust - CVE-2026-1731 - Canadian Centre for Cyber SecurityOpen source ↗

Cyber Security NewsNews · Feb 16, 2026

Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain ControlOpen source ↗

Bleeping ComputerNews · Feb 16, 2026

CISA gives feds 3 days to patch actively exploited BeyondTrust flawOpen source ↗

Security Online InfoNews · Feb 15, 2026

Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network TakeoverOpen source ↗

20 additional sources from 09-02-2026 to 14-02-2026

Rapid7 BlogNews · Feb 9, 2026

CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)Open source ↗

Belgium Ccb Security AdvisoriesNews · Feb 9, 2026

Warning: Remote Code Execution in BeyondTrust Remote Support and Privileged Remote Access, Patch Immediately! | CCB SafeonwebOpen source ↗

Bleeping ComputerNews · Feb 9, 2026

BeyondTrust warns of critical RCE flaw in remote support softwareOpen source ↗

Help Net SecurityNews · Feb 9, 2026

BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731) - Help Net SecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

BeyondTrust Pre-Authentication RCE in Remote Support and Privileged Remote Access (CVE-2026-1731)

How this story unfolded

Canadian Cyber Centre issues alert citing active exploitation

CISA sets February 16 deadline for federal remediation

CISA adds CVE-2026-1731 to the KEV catalog

Arctic Wolf links exploitation to post-compromise intrusion activity

In-the-wild exploitation of CVE-2026-1731 is confirmed

Researchers publish technical exploitation details and detection observations

GreyNoise observes reconnaissance for vulnerable BeyondTrust systems

Public PoC exploit for CVE-2026-1731 is posted to GitHub

National cyber agencies issue advisories on BeyondTrust flaw

Researcher Harsh Jaiswal and Hacktron AI report the vulnerability

BeyondTrust discloses CVE-2026-1731 and releases self-hosted patches

BeyondTrust patches SaaS RS and PRA instances for CVE-2026-1731

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical RCE in BeyondTrust Remote Support and Privileged Remote Access

Critical Authentication Bypass Flaws Hit BeyondTrust Remote Support and PRA

BeyondTrust CVE-2026-1731 Exploited to Deploy Backdoors on Remote Access Servers

BeyondTrust Pre-Authentication RCE in Remote Support and Privileged Remote Access (CVE-2026-1731)

How this story unfolded

Canadian Cyber Centre issues alert citing active exploitation

CISA sets February 16 deadline for federal remediation

CISA adds CVE-2026-1731 to the KEV catalog

Arctic Wolf links exploitation to post-compromise intrusion activity

In-the-wild exploitation of CVE-2026-1731 is confirmed

Researchers publish technical exploitation details and detection observations

GreyNoise observes reconnaissance for vulnerable BeyondTrust systems

Public PoC exploit for CVE-2026-1731 is posted to GitHub

National cyber agencies issue advisories on BeyondTrust flaw

Researcher Harsh Jaiswal and Hacktron AI report the vulnerability

BeyondTrust discloses CVE-2026-1731 and releases self-hosted patches

BeyondTrust patches SaaS RS and PRA instances for CVE-2026-1731

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical RCE in BeyondTrust Remote Support and Privileged Remote Access

Critical Authentication Bypass Flaws Hit BeyondTrust Remote Support and PRA

BeyondTrust CVE-2026-1731 Exploited to Deploy Backdoors on Remote Access Servers