Critical WebSocket RCE in BeyondTrust Remote Support and PRA

A critical vulnerability tracked as CVE-2026-1731 affects BeyondTrust Remote Support and Privileged Remote Access (PRA), allowing unauthenticated remote code execution through a WebSocket-reachable component. Public reporting describes the flaw as a command injection issue caused by unsafe Bash arithmetic evaluation, exposing internet-facing deployments to takeover without valid credentials.

Technical references indicate the vulnerable path is reachable over WebSocket and can be exploited to execute arbitrary commands on affected systems. The issue has been documented by ProjectDiscovery and accompanied by a public GitHub repository detailing exploitation of CVE-2026-1731, increasing the likelihood of attacker interest and rapid weaponization against exposed BeyondTrust environments.