Loading vulnerability…
Pre-authentication OS command injection in BeyondTrust Remote Support and Privileged Remote Access
CVE-2026-1731 is a critical pre-authentication operating system command injection vulnerability affecting BeyondTrust Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier. Improper neutralization of special elements in operating system commands allows an unauthenticated remote attacker to submit specially crafted requests and execute commands in the context of the site user. Exploitation requires no user interaction. The vulnerability has been exploited in initial-access campaigns and ransomware attacks.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the affected service through arbitrary operating system command execution as the site user, threatening confidentiality, integrity, and availability. Subsequent access to other systems depends on the account's permissions and the deployment environment. Observed post-exploitation activity has included privilege escalation, data exfiltration, deployment of SNOWLIGHT and SPARKRAT, cryptomining, and ransomware deployment. Root access is not an established direct consequence of the vulnerability itself.
If you can’t patch tonight, do this now.
Prioritize updates and increase monitoring for suspicious appliance activity and unauthorized command execution. Investigate potentially exposed deployments for prior compromise: patching prevents subsequent exploitation but does not remove an existing compromise. Network segmentation and filtering untrusted access to remote-access services can reduce exposure while remediation is completed, but do not replace patching.
Patch, then assume compromise.
Apply BeyondTrust patch BT26-02-RS for Remote Support or BT26-02-PRA for Privileged Remote Access, as appropriate, following advisory BT26-02. Alternatively, upgrade Remote Support to version 25.3.2 or later, or Privileged Remote Access to version 25.1.1 or later. Self-hosted customers without automatic updates must install the appropriate update manually and verify installation. BeyondTrust patched Remote Support SaaS customers by February 2, 2026.
4 exploits validated by Mallory's analysis. Hidden: 8 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
351 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.