CVE-2026-1731
Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
9.9 (CRITICAL)
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 94% (percentile: 100) as of 1 November 2026
- CWE
- CWE-78
Affected products
beyondtrust: privileged remote access; beyondtrust: remote support
References
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 Vendor Advisory
- https://github.com/win3zz/CVE-2026-1731 ExploitThird Party Advisory
- https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=K… Permissions Required
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026… US Government Resource
- https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731 Third Party Advisory