Loading story…
BeyondTrust Remote Support is being actively exploited via CVE-2026-1731, a critical pre-authentication OS command injection / RCE flaw (CVSS 9.9) in the thin-scc-wrapper component exposed to the internet via WebSocket. Reporting indicates attackers can execute system commands without logging in, enabling rapid progression from initial access to full compromise, including reconnaissance, account creation, webshell deployment, C2 activity, lateral movement, and data theft. Victimology described to date spans multiple sectors—financial services, healthcare, legal services, higher education, and technology/retail—across the U.S., France, Germany, Australia, and Canada, with telemetry indicating 10,600+ exposed instances potentially at risk.
Threat activity observed in exploitation includes deployment of two prominent remote-access backdoors: VShell (noted for stealthy, service-like behavior and fileless/memory execution on Linux) and SparkRAT (an open-source Go-based RAT previously seen in campaigns linked to DragonSpark). Due to confirmed exploitation, CISA added CVE-2026-1731 to the KEV Catalog (Feb. 13, 2026), signaling urgent patching/mitigation prioritization. Separate reporting in the same period covered unrelated critical issues in GNU Inetutils telnetd (CVE-2026-24061) and an exploitation surge affecting Ivanti products (CVE-2025-0282/CVE-2025-0283), but those are distinct from the BeyondTrust activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
BeyondTrust stated that exploitation of CVE-2026-1731 was first detected on 2026-01-31 and was largely limited to unpatched, internet-facing, self-hosted appliances before 2026-02-09. This disclosure clarified the campaign's start and early scope.
By 2026-02-20, CISA had updated its KEV entry for CVE-2026-1731 to state that ransomware actors were exploiting the vulnerability. This marked an escalation from general active exploitation to confirmed use in ransomware campaigns.
On 2026-02-20, reporting said the U.S. Department of Health and Human Services issued an alert urging healthcare and public health organizations to review and address CVE-2026-1731. The warning highlighted the risk that the flaw could give attackers an initial foothold in hospital and clinic networks.
By 2026-02-19, Palo Alto Networks Unit 42 reported active in-the-wild exploitation of CVE-2026-1731 affecting multiple industries and countries. Observed post-exploitation activity included reconnaissance, web shell deployment, persistence, lateral movement, and use of VShell and SparkRAT.
On 2026-02-13, CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalog, requiring U.S. federal agencies to remediate it on an urgent timeline. Other organizations were also urged to take immediate action.
A public proof-of-concept for CVE-2026-1731 was released on 2026-02-10. Reporting says exploitation activity accelerated after the PoC became available.
On 2026-02-06, BeyondTrust disclosed the critical pre-authentication command-injection flaw CVE-2026-1731 affecting Remote Support and Privileged Remote Access, and issued fixes. The company advised customers to upgrade to patched versions, including Remote Support 25.3.2 and Privileged Remote Access 25.1.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesecurityaffairs.com
Open sourcesecpod.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcedatabreaches.net
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical **pre-authentication remote code execution** flaw in BeyondTrust Remote Support and some older versions of Privileged Remote Access, tracked as `CVE-2026-1731`, has been actively exploited against internet-facing systems. The bug is described as an unauthenticated operating system command injection vulnerability that lets attackers execute arbitrary commands on affected servers. BeyondTrust patched its SaaS customers on February 2 and urged self-hosted customers to apply fixes, while **CISA** added the vulnerability to its Known Exploited Vulnerabilities catalog and public exploit code later appeared on GitHub. Incident responders and threat researchers reported a rise in post-exploitation activity across multiple BeyondTrust customers in sectors including **financial services, technology, higher education, legal services, and healthcare**. Palo Alto Networks Unit 42 observed attackers deploying **SparkRAT** and **vShell** backdoors, using remote management and tunneling tools for reconnaissance and persistence, and in some cases conducting environment enumeration and suspected data theft. Censys and other researchers also warned that exposed BeyondTrust instances were reachable from the internet, underscoring the risk of rapid compromise where patches had not been applied.
Jun 29, 2026
A critical vulnerability tracked as **`CVE-2026-1731`** affects **BeyondTrust Remote Support** and **Privileged Remote Access (PRA)**, allowing **unauthenticated remote code execution** through a WebSocket-reachable component. Public reporting describes the flaw as a **command injection** issue caused by **unsafe Bash arithmetic evaluation**, exposing internet-facing deployments to takeover without valid credentials. Technical references indicate the vulnerable path is reachable over WebSocket and can be exploited to execute arbitrary commands on affected systems. The issue has been documented by ProjectDiscovery and accompanied by a public GitHub repository detailing exploitation of `CVE-2026-1731`, increasing the likelihood of attacker interest and rapid weaponization against exposed BeyondTrust environments.
Jul 12, 2026
BeyondTrust disclosed and fixed **CVE-2026-1731**, a critical unauthenticated remote code execution flaw affecting **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**. The vulnerability allows a remote attacker to send crafted client requests and execute system commands on the target appliance as the **site user**, creating a path to full system compromise, data theft, and service disruption. CSIRT.SK reported the issue carries a **CVSS score of 9.9**. BeyondTrust said cloud instances were updated automatically, while organizations running on-premises deployments were told to upgrade to **Remote Support 25.3.2** and **Privileged Remote Access 25.1.1**, or apply the vendor patches **`BT26-02-RS`** and **`BT26-02-PRA`**. The advisory identifies the flaw as a high-priority risk for enterprises using BeyondTrust remote access and support platforms because exploitation requires no authentication and can result in command execution on exposed systems.
Jul 24, 2026