Loading story…
Best Practical RT fixed CVE-2026-44231, a high-severity flaw in the REST 2.0 API that let a privileged non-administrative user obtain authentication credentials belonging to other users, including administrators. The issue affected RT versions before 5.0.10 and 6.0.0 through before 6.0.3, enabling attackers to use exposed credentials to read data through RT feed endpoints while also rotating those credentials and invalidating previously distributed feed URLs across the instance.
Best Practical addressed the vulnerability in RT 5.0.10 and RT 6.0.3, and said the 6.0.3 release also fixes several other security issues, including SQL injection in JSON search, LDAP authentication bypass, CSRF, stored and reflected XSS, and spreadsheet injection in exported search results. The vendor urged users to upgrade, but also warned that a mitigation for TSV export header spreadsheet injection tied to CVE-2026-41073 was accidentally left out of RT 6.0.3, recommending a separate patch until RT 6.0.4 ships.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry documented CVE-2026-44231 as an information disclosure and privilege escalation vulnerability in Best Practical RT's REST 2.0 API. The entry states the flaw affects versions prior to 5.0.10 and 6.0.0 through before 6.0.3, and that it was fixed in versions 5.0.10 and 6.0.3.
On 2026-05-20, Best Practical released Request Tracker 6.0.3 and urged users to upgrade. The release fixed multiple vulnerabilities, including the REST 2.0 user collection endpoint flaw later tracked as CVE-2026-44231.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BeyondTrust disclosed and fixed **CVE-2026-1731**, a critical unauthenticated remote code execution flaw affecting **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**. The vulnerability allows a remote attacker to send crafted client requests and execute system commands on the target appliance as the **site user**, creating a path to full system compromise, data theft, and service disruption. CSIRT.SK reported the issue carries a **CVSS score of 9.9**. BeyondTrust said cloud instances were updated automatically, while organizations running on-premises deployments were told to upgrade to **Remote Support 25.3.2** and **Privileged Remote Access 25.1.1**, or apply the vendor patches **`BT26-02-RS`** and **`BT26-02-PRA`**. The advisory identifies the flaw as a high-priority risk for enterprises using BeyondTrust remote access and support platforms because exploitation requires no authentication and can result in command execution on exposed systems.
Jul 24, 2026
BeyondTrust disclosed multiple vulnerabilities affecting **Remote Support** and **Privileged Remote Access** appliances, including two critical pre-authentication authentication-bypass flaws tracked as `CVE-2026-40138` and `CVE-2026-40139`. Both issues carry **CVSS 9.2** ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, `CVE-2026-40140`, was rated **CVSS 8.7** and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem. BeyondTrust also addressed `CVE-2026-40141`, a **CVSS 8.5** vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are **Remote Support 25.3.2 and earlier** and **Privileged Remote Access 25.3.2 and earlier**. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.
Jul 9, 2026
BeyondTrust released security updates for a **critical pre-authentication remote code execution** vulnerability in *BeyondTrust Remote Support (RS)* and certain older versions of *Privileged Remote Access (PRA)*. Tracked as **CVE-2026-1731** (CVSS **9.9**), the issue is described as an **operating system command injection** that can be triggered via **specially crafted requests** without authentication, allowing an attacker to execute OS commands in the context of the **site user** and potentially enabling **unauthorized access, data exfiltration, and service disruption**. Affected versions include **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**. BeyondTrust provided fixes via **RS Patch `BT26-02-RS` / RS 25.3.2+** and **PRA Patch `BT26-02-PRA` / PRA 25.1.1+**, and urged **self-hosted** customers to manually apply updates if not enrolled in automatic updates; older deployments (e.g., RS <21.3 or PRA <22.1) must first upgrade to a supported release line to apply the remediation. BeyondTrust’s **SaaS** instances were patched automatically (reported as completed on **2026-02-02**), reducing exposure primarily to organizations operating **self-managed** installations.
Jun 29, 2026