BeyondTrust Warns of Critical RCE Vulnerability in Remote Support Software
- Securityish
- Threats & Incidents
Quick Summary
BeyondTrust has alerted customers to a critical remote code execution vulnerability, tracked as CVE-2026-1731, in its Remote Support and Privileged Remote Access software. This flaw allows unauthenticated attackers to execute arbitrary code remotely, affecting versions 25.3.1 and earlier for Remote Support and 24.3.4 and earlier for Privileged Remote Access. Approximately 11,000 instances are exposed to the internet, with 8,500 on-prem deployments potentially vulnerable if not patched, highlighting significant cybersecurity risks for organizations using this software.
The Securityish Brief
BeyondTrust has issued a warning regarding a critical security flaw in its Remote Support (RS) and Privileged Remote Access (PRA) software. This vulnerability, identified as CVE-2026-1731, is a pre-authentication remote code execution issue stemming from an OS command injection weakness. Discovered by Harsh Jaiswal and the Hacktron AI team, it affects Remote Support versions 25.3.1 and earlier, as well as Privileged Remote Access versions 24.3.4 and earlier.
The flaw allows unauthenticated attackers to exploit the software through specially crafted client requests, enabling them to execute arbitrary operating system commands without requiring user interaction. BeyondTrust has reported that approximately 11,000 instances of its software are exposed to the internet, with around 8,500 of those being on-premises deployments that remain vulnerable if patches are not applied.
BeyondTrust has taken steps to secure its cloud systems by February 2, 2026, and has advised on-premises customers to upgrade to Remote Support version 25.3.2 or later and Privileged Remote Access version 25.1.1 or later if they have not enabled automatic updates. The potential impact of this vulnerability includes unauthorized access, data exfiltration, and service disruption.
In June 2025, BeyondTrust addressed another high-severity vulnerability in its RS/PRA software, which also allowed unauthenticated remote code execution. The company has faced scrutiny in the past, as attackers exploited previous vulnerabilities to compromise its systems, including a breach that affected 17 Remote Support SaaS instances.
Notably, the U.S. Treasury Department was hacked through a compromised BeyondTrust instance, with links to the Silk Typhoon Chinese state-backed hacking group. This incident underscores the importance of timely patching and monitoring of vulnerabilities in remote support solutions.
Why This Matters for Your Security
Organizations using BeyondTrust’s software should take immediate action to mitigate risks associated with CVE-2026-1731. The ease of exploitation, combined with the lack of required authentication, makes this vulnerability particularly concerning. Companies must ensure that their systems are updated to the latest versions to protect against potential attacks.
Furthermore, this incident highlights the broader risks associated with remote support software, which can be targeted by threat actors. Organizations should regularly review their security posture and ensure that they are not only applying patches but also monitoring for unusual activity that may indicate exploitation attempts.
Key Takeaways
- Update BeyondTrust Remote Support to version 25.3.2 or later to mitigate the vulnerability.
- Upgrade Privileged Remote Access to version 25.1.1 or later if automatic updates are not enabled.
- Regularly monitor systems for unusual activity that may indicate exploitation attempts.
- Review and strengthen security protocols for remote support software to prevent unauthorized access.
- Stay informed about new vulnerabilities and apply patches promptly to maintain security.
Key Terms & Concepts
- CVE-2026-1731: In this article, CVE-2026-1731 refers to a critical remote code execution vulnerability in BeyondTrust’s software.
- Remote Code Execution: Remote Code Execution is a type of vulnerability that allows attackers to execute commands on a remote system without authorization.
- OS Command Injection: OS Command Injection is a security vulnerability that allows an attacker to execute arbitrary commands on the operating system via a vulnerable application.
- Silk Typhoon: Silk Typhoon is a Chinese state-backed hacking group linked to cyberattacks against various organizations, including the U.S. Treasury Department.
Read the original article here: https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-rce-flaw-in-remote-support-software/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
