Loading story…
U.S. health-sector authorities warned hospitals and clinics to urgently patch a critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access that can provide attackers an initial foothold and enable unauthorized control of affected appliances inside enterprise networks. The flaw is tracked as CVE-2026-1731 and was highlighted to the healthcare and public health sector amid increased targeting of those organizations.
CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities (KEV) catalog and set an accelerated remediation deadline for federal agencies, later updating the entry to warn that ransomware operators are actively exploiting the issue. Palo Alto Networks Unit 42 also reported observed in-the-wild exploitation, describing threat actors weaponizing the vulnerability to take control of appliances and expand access within victim environments, increasing risk to clinical networks if unpatched.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
HHS issued an alert to the healthcare and public health sector urging organizations to review and remediate the BeyondTrust vulnerability amid rising cyberattacks on the sector. The warning highlighted the risk that exploitation could provide attackers an initial foothold in clinical and corporate networks.
Palo Alto Networks Unit 42 reported that attackers were actively exploiting CVE-2026-1731 in BeyondTrust products. BeyondTrust warned successful exploitation could enable unauthorized access, data exfiltration, service disruption, and broader system compromise.
CISA later updated the KEV entry for CVE-2026-1731 to note that ransomware actors were exploiting the vulnerability. This marked an escalation from general active exploitation to ransomware-linked abuse.
CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalog on February 13, 2026, indicating the flaw was being actively exploited. Federal agencies were given a three-day deadline to remediate the issue.
Health-ISAC issued a bulletin to the healthcare sector warning about the BeyondTrust vulnerability and its potential impact on provider organizations. The group emphasized the products are widely used for remote IT and clinical engineering support, raising the risk of enterprise-wide disruption and patient care impacts.
BeyondTrust released patches for a critical flaw in Remote Support and Privileged Remote Access on February 2, 2026. The company said updates were automatically deployed for instances using its update service and fully applied in SaaS environments.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical **pre-authentication remote code execution** flaw in BeyondTrust Remote Support and some older versions of Privileged Remote Access, tracked as `CVE-2026-1731`, has been actively exploited against internet-facing systems. The bug is described as an unauthenticated operating system command injection vulnerability that lets attackers execute arbitrary commands on affected servers. BeyondTrust patched its SaaS customers on February 2 and urged self-hosted customers to apply fixes, while **CISA** added the vulnerability to its Known Exploited Vulnerabilities catalog and public exploit code later appeared on GitHub. Incident responders and threat researchers reported a rise in post-exploitation activity across multiple BeyondTrust customers in sectors including **financial services, technology, higher education, legal services, and healthcare**. Palo Alto Networks Unit 42 observed attackers deploying **SparkRAT** and **vShell** backdoors, using remote management and tunneling tools for reconnaissance and persistence, and in some cases conducting environment enumeration and suspected data theft. Censys and other researchers also warned that exposed BeyondTrust instances were reachable from the internet, underscoring the risk of rapid compromise where patches had not been applied.
Jun 29, 2026
Ransomware affiliates mounted a coordinated wave of attacks against internet-facing VPN and firewall appliances from **Palo Alto Networks, Fortinet, Check Point, and Citrix**, turning edge remote-access systems into a primary entry point for corporate intrusions. Reported campaigns included **FortiBleed** credential exposure on FortiGate devices, exploitation of Palo Alto GlobalProtect authentication bypass `CVE-2026-0257`, abuse of Check Point VPN authentication bypass `CVE-2026-50751`, and rapid exploitation of Citrix NetScaler memory-disclosure flaw `CVE-2026-8451`. Security reporting linked **Qilin** affiliates to at least the Palo Alto and Check Point activity, with exploitation beginning within days—and in some cases less than 24 hours—after disclosure or proof-of-concept release. After gaining access, attackers were reported using lateral movement and credential-theft techniques including **Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI**, Chrome credential theft via GPO, and **WSL-based EDR evasion**, followed by data theft and double-extortion ransomware deployment. Victims were concentrated in the United States, United Kingdom, Australia, and Western Europe across healthcare, education, manufacturing, local government, media, professional services, and critical infrastructure. The surge prompted Sen. **Ron Wyden** to call for a federal purge of legacy, public-facing VPNs, urging **OMB, CISA, and NIST** to push agencies toward zero-trust remote access and away from perimeter-based systems repeatedly exposed by incidents involving Fortinet, Check Point, Ivanti, and Cisco platforms.
Jul 27, 2026
BeyondTrust disclosed and fixed **CVE-2026-1731**, a critical unauthenticated remote code execution flaw affecting **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**. The vulnerability allows a remote attacker to send crafted client requests and execute system commands on the target appliance as the **site user**, creating a path to full system compromise, data theft, and service disruption. CSIRT.SK reported the issue carries a **CVSS score of 9.9**. BeyondTrust said cloud instances were updated automatically, while organizations running on-premises deployments were told to upgrade to **Remote Support 25.3.2** and **Privileged Remote Access 25.1.1**, or apply the vendor patches **`BT26-02-RS`** and **`BT26-02-PRA`**. The advisory identifies the flaw as a high-priority risk for enterprises using BeyondTrust remote access and support platforms because exploitation requires no authentication and can result in command execution on exposed systems.
Jul 24, 2026