CVE-2026-1731

9.9

CRITICAL CVSS 4.0

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability - [Actively Exploited]

Description

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

INFO

Published Date :

Feb. 6, 2026, 10:16 p.m.

Last Modified :

Feb. 17, 2026, 1:40 p.m.

Remotely Exploit :

Yes !

Source :

13061848-ea10-403d-bd75-c83a022c2891

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Feb 16, 2026

Alert Date: Feb 13, 2026 | 14 days ago

Description :

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Known Detected Feb 26, 2026

Notes :

Please adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 ; https://nvd.nist.gov/vuln/detail/CVE-2026-1731

Affected Products

The following products are affected by CVE-2026-1731 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Beyondtrust	remote_support
2	Beyondtrust	privileged_remote_access

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	CRITICAL	[email protected]
CVSS 4.0	CRITICAL	13061848-ea10-403d-bd75-c83a022c2891
CVSS 4.0	CRITICAL	13061848-ea10-403d-bd75-c83a022c2891

Solution

Update BeyondTrust RS/PRA to patch the pre-authentication command execution vulnerability.

Update BeyondTrust Remote Support to the latest version.
Update Privileged Remote Access to the latest version.

Public PoC/Exploit Available at Github

CVE-2026-1731 has a 14 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-1731.

URL	Resource
https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293	Permissions Required
https://www.beyondtrust.com/trust-center/security-advisories/bt26-02	Vendor Advisory
https://github.com/win3zz/CVE-2026-1731	Exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731	US Government Resource
https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731	Third Party Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-1731 is associated with the following CWEs:

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-1731 weaknesses.

CAPEC-6: Argument Injection Argument Injection CAPEC-15: Command Delimiters Command Delimiters CAPEC-43: Exploiting Multiple Input Interpretation Layers Exploiting Multiple Input Interpretation Layers CAPEC-88: OS Command Injection OS Command Injection CAPEC-108: Command Line Execution through SQL Injection Command Line Execution through SQL Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

cybrdude/cybrdude

None

Python

Updated: 3 days, 13 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 23, 2026, 6:30 a.m. This repo has been linked 2 different CVEs too.

hexissam/CVE-2026-1731

CVE-2026-1731 — BeyondTrust Remote Code Execution Vulnerability

Python

Updated: 5 days, 9 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 22, 2026, 10:05 a.m. This repo has been linked 1 different CVEs too.

AlexRodriguezA/CyberBriefBot

None

Updated: 5 days, 20 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 21, 2026, 10:57 p.m. This repo has been linked 1 different CVEs too.

kapetanios55/SentinelCBContent

None

Shell Python

Updated: 1 day, 11 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 20, 2026, 10:40 p.m. This repo has been linked 23 different CVEs too.

richardpaimu34/CVE-2026-1731

None

Updated: 6 days, 21 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 20, 2026, 10:31 p.m. This repo has been linked 1 different CVEs too.

jakubie07/CVE-2026-1731

CVE-2026-1731 PoC

beyondtrust cve-2026-1731 poc rce cve-2026

Rust

Updated: 5 days, 8 hours ago

4 stars 0 fork 0 watcher

Born at : Feb. 18, 2026, 6:05 a.m. This repo has been linked 1 different CVEs too.

cybrdude/cve-2026-1731-scanner

Passive vulnerability scanner for CVE-2026-1731 — BeyondTrust RS/PRA pre-auth RCE (CVSS 9.9). Educational & defensive use only.

beyondtrust cve-2026-1731 infosec passive-scanner security-tools vulnerability-scanner privileged-remote-access

Python

Updated: 1 week ago

4 stars 0 fork 0 watcher

Born at : Feb. 13, 2026, 7:48 p.m. This repo has been linked 2 different CVEs too.

bytehazard/CVE-2026-1731

None

Updated: 2 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 11, 2026, 7:05 p.m. This repo has been linked 1 different CVEs too.

win3zz/CVE-2026-1731

CVE-2026-1731 - Critical command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access due to unsafe Bash arithmetic evaluation in a WebSocket-reachable script

beyondtrust remote-access vulnerability-detection cve-2026-1731

Python

Updated: 2 weeks ago

11 stars 2 fork 2 watcher

Born at : Feb. 11, 2026, 9:18 a.m. This repo has been linked 2 different CVEs too.

z3r0h3ro/CVE-2026-1731-exp

None

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 10, 2026, 3:53 p.m. This repo has been linked 1 different CVEs too.

m00mba/scripts

None

Python

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 10, 2026, 4:06 a.m. This repo has been linked 1 different CVEs too.

Threekiii/CVE

一个 CVE 漏洞预警知识库，无 exp/poc，部分包含修复方案。A knowledge base of CVE security vulnerability, no PoCs/exploits.

Updated: 3 days, 12 hours ago

159 stars 23 fork 23 watcher

Born at : Jan. 5, 2023, 2:19 a.m. This repo has been linked 230 different CVEs too.

GhostTroops/TOP

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

bugbounty cve exp exploit payload poc rce vulnerability

Shell

Updated: 18 hours, 15 minutes ago

719 stars 123 fork 123 watcher

Born at : March 19, 2022, 1:54 a.m. This repo has been linked 283 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 4 hours, 34 minutes ago

7549 stars 1241 fork 1241 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 756 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-1731 vulnerability anywhere in the article.

Daily CyberSecurity

Hackers Exploit Critical BeyondTrust Flaw to Deploy VShell and SparkRAT Across Multiple Sectors

A critical security flaw in a widely used enterprise access platform is under active attack, prompting urgent warnings from cybersecurity researchers and federal agencies alike. According to a new thr ...

Published Date: Feb 23, 2026 (4 days, 19 hours ago)

The Hacker News

BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration

Threat actors have been observed exploiting a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to conduct a wide range of ...

Published Date: Feb 20, 2026 (1 week ago)

security.nl

Kritiek lek in BeyondTrust Remote Support gebruikt bij ransomware-aanvallen

Een kritieke kwetsbaarheid in BeyondTrust Remote Support en BeyondTrust Privileged Remote Access wordt gebruikt bij ransomware-aanvallen, aldus het Amerikaanse cyberagentschap CISA. Via BeyondTrust Re ...

Published Date: Feb 20, 2026 (1 week ago)

CybersecurityNews

Hackers Actively Exploiting Critical BeyondTrust Vulnerability to Deploy VShell and SparkRAT

A critical vulnerability in BeyondTrust’s remote support software is being actively exploited by hackers to deliver dangerous backdoors on compromised systems. The flaw, tracked as CVE-2026-1731, carr ...

Published Date: Feb 20, 2026 (1 week ago)

The Hacker News

Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware

This week’s recap shows how small gaps are turning into big entry points. Not always through new exploits, often through tools, add-ons, cloud setups, or workflows that people already trust and rarely ...