Quick Summary
A critical remote code execution vulnerability, tracked as CVE-2026-1731, affects BeyondTrust Remote Support and Privileged Remote Access appliances. This flaw, with a CVSS score of 9.9, allows unauthenticated attackers to execute commands remotely. BeyondTrust disclosed the vulnerability on February 6, 2026, after it was discovered that approximately 11,000 instances were exposed online, with active exploitation reported shortly after a proof-of-concept was published.
The Securityish Brief
BeyondTrust has identified a critical pre-authentication remote code execution vulnerability in its Remote Support and Privileged Remote Access appliances, tracked as CVE-2026-1731. This flaw, which has a near-maximum CVSS score of 9.9, affects Remote Support versions 25.3.1 and earlier, as well as Privileged Remote Access versions 24.3.4 and earlier. The vulnerability was disclosed on February 6, 2026, following its discovery by Hacktron, who responsibly reported it on January 31.
Attackers can exploit this vulnerability by sending specially crafted client requests, allowing them to execute operating system commands without authentication. This poses a significant risk, as successful exploitation may lead to unauthorized access, data exfiltration, and service disruption. As of now, it has been reported that around 11,000 BeyondTrust Remote Support instances are exposed online, with approximately 8,500 being on-premises deployments.
Following the publication of a proof-of-concept exploit on GitHub, attackers have begun actively exploiting this vulnerability. Reports indicate that they are using the ‘get_portal_info’ endpoint to extract the ‘X-Ns-Company’ identifier, which is then utilized to establish a WebSocket channel for command execution on vulnerable systems.
Implications for Organizations
Organizations utilizing self-hosted BeyondTrust Remote Support or Privileged Remote Access appliances should prioritize applying the available patches or upgrading to the latest versions. BeyondTrust has automatically patched all Remote Support and Privileged Remote Access SaaS instances as of February 2, 2026, but on-premise customers must take action manually.
The rapid exploitation of this vulnerability highlights the ongoing risks associated with unpatched systems. Organizations should assume that any unpatched devices may already be compromised and take immediate steps to secure their environments. This incident serves as a reminder of the importance of timely updates and monitoring for vulnerabilities in critical software.
Key Takeaways
- Immediately apply available patches for BeyondTrust Remote Support and Privileged Remote Access appliances.
- Upgrade to the latest versions of BeyondTrust software to mitigate risks associated with CVE-2026-1731.
- Monitor your systems for any signs of unauthorized access or exploitation attempts.
- Review and enhance your organization’s patch management policies to ensure timely updates.
- Educate your team about the risks of unpatched vulnerabilities and the importance of security hygiene.
Key Terms & Concepts
- CVE-2026-1731: In this article, CVE-2026-1731 refers to a critical remote code execution vulnerability in BeyondTrust software.
- CVSS: CVSS stands for Common Vulnerability Scoring System, which is a standard for assessing the severity of security vulnerabilities.
Read the original article here: https://www.bleepingcomputer.com/news/security/critical-beyondtrust-rce-flaw-now-exploited-in-attacks-patch-now/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
