BeyondTrust CVE-2026-1731 Exploited to Deploy Backdoors on Remote Access Servers

A critical pre-authentication remote code execution flaw in BeyondTrust Remote Support and some older versions of Privileged Remote Access, tracked as CVE-2026-1731, has been actively exploited against internet-facing systems. The bug is described as an unauthenticated operating system command injection vulnerability that lets attackers execute arbitrary commands on affected servers. BeyondTrust patched its SaaS customers on February 2 and urged self-hosted customers to apply fixes, while CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and public exploit code later appeared on GitHub.

Incident responders and threat researchers reported a rise in post-exploitation activity across multiple BeyondTrust customers in sectors including financial services, technology, higher education, legal services, and healthcare. Palo Alto Networks Unit 42 observed attackers deploying SparkRAT and vShell backdoors, using remote management and tunneling tools for reconnaissance and persistence, and in some cases conducting environment enumeration and suspected data theft. Censys and other researchers also warned that exposed BeyondTrust instances were reachable from the internet, underscoring the risk of rapid compromise where patches had not been applied.