CVE-2026-1731
An unauthenticated attacker can execute OS commands in BeyondTrust Remote Support and Privileged Remote Access.
This is a pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and older versions of Privileged Remote Access. It allows an unauthenticated remote attacker to send crafted requests and run operating system commands. CISA lists it as actively exploited, and US federal agencies must fix it by February 16, 2026.
BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA) · Updated 28 Oct · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 13 Feb; US agencies must fix by 16 Feb. Used by ransomware gangs
SeveritycriticalCVSS 9.9 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- There is no fixed version given in the available records; check BeyondTrust's official advisory for the specific patched versions.
- If no fix is available yet, follow the workaround suggested by BeyondTrust in their security advisory, as the records do not specify one.
- Ensure your BeyondTrust products are updated as soon as a patch is released, since this flaw is listed by CISA as actively exploited.
What happened
- 13 FebCISA added CVE-2026-1731 to its known-exploited list and required US federal agencies to fix by February 16, 2026.
- 19 OctRapid7 reported that the BeyondTrust Remote Support authentication bypass is being exploited in the wild.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-1731 | Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | critical 9.9 | 13 Feb | 93% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
Rapid7 · 19 OctCVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild ↗The records
CISA known-exploited catalog ↗CVE-2026-1731 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works