Critical RCE in BeyondTrust Remote Support and Privileged Remote Access
Attack Surface Exposure · 2 sources · Updated 3mo ago · First seen Feb 16, 2026
BeyondTrust disclosed and fixed CVE-2026-1731, a critical unauthenticated remote code execution flaw affecting Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier. The vulnerability allows a remote attacker to send crafted client requests and execute system commands on the target appliance as the site user, creating a path to full system compromise, data theft, and service disruption. CSIRT.SK reported the issue carries a CVSS score of 9.9.
BeyondTrust said cloud instances were updated automatically, while organizations running on-premises deployments were told to upgrade to Remote Support 25.3.2 and Privileged Remote Access 25.1.1, or apply the vendor patches BT26-02-RS and BT26-02-PRA. The advisory identifies the flaw as a high-priority risk for enterprises using BeyondTrust remote access and support platforms because exploitation requires no authentication and can result in command execution on exposed systems.
