CVE-2026-1731 – Critical Pre‑Auth RCE in BeyondTrust Remote Support & Privileged Remote Access

Key Takeaways

Severity: Critical (CVSS 9.8/9.9)

Impact: Unauthenticated remote code execution (OS command injection) in BeyondTrust Remote Support (RS) and older Privileged Remote Access (PRA) deployments.

Who is affected: All on‑premises and self‑hosted cloud instances of RS and PRA; SaaS/Cloud versions have been patched.

Current status: Actively exploited in the wild; added to CISA KEV on 2026‑02‑13.

Immediate action: Apply the vendor patch (BT26‑02) or disable the vulnerable service; begin monitoring for exploitation indicators.

Overview

A pre‑authentication remote code execution flaw was disclosed in BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA). An unauthenticated attacker can send a specially crafted HTTP request that triggers OS‑level command execution in the context of the web‑application user. The vulnerability was publicly disclosed on 2026‑02‑06, a PoC appeared on 2026‑02‑11, and active exploitation was observed within hours. CISA added the issue to its Known Exploited Vulnerabilities (KEV) catalog on 2026‑02‑13, flagging it as a high‑priority threat for all organizations using the affected products.

Technical Details

Vulnerability type: CWE‑78 – OS Command Injection.
Attack vector: Network‑reachable (AV:N), no authentication required (PR:N), no user interaction (UI:N). The exploit abuses the get_portal_info endpoint to retrieve the x‑ns‑company header, then upgrades to a WebSocket channel to deliver arbitrary commands.
CVSS scores:
- CVSS 4.0: 9.9 – CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L
- CVSS 3.1: 9.8 – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit timeline (key signals):
- 2026‑02‑07: Vendor advisory released (BT26‑02) – patch for SaaS/Cloud, guidance for self‑hosted.
- 2026‑02‑11: Public PoC posted on GitHub.
- 2026‑02‑12: First in‑the‑wild exploitation observed (global sensors reported WebSocket abuse).
- 2026‑02‑13: Added to CISA KEV.
- 2026‑02‑21 – 23: Spike in active exploitation reports (2 → 18 daily mentions).
- Late February – early March: Exploit tool releases, continued low‑level activity.

For a full timeline and signal breakdown, see the live CVE page on VulnSocial: https://vulnsocial.com/cve/CVE-2026-1731.

Severity & Impact

Metric	Value
Severity	Critical
CVSS 3.1 Base	9.8
CVSS 4.0 Base	9.9
CWE	CWE‑78 (OS Command Injection)
CISA KEV	Yes (added 2026‑02‑13)

The high CVSS scores reflect complete compromise of the affected host, allowing attackers to execute arbitrary commands, install ransomware, or pivot to other internal systems.

Affected Products

Vendor: BeyondTrust
Products: Remote Support (RS) and older versions of Privileged Remote Access (PRA).

All on‑premises and self‑hosted cloud deployments are vulnerable. SaaS/Cloud instances have been patched by the vendor. For the exhaustive list of affected versions and CPE entries, consult the VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2026-1731.

Actionable Insights – What to Monitor

Network traffic: Look for HTTP GET /get_portal_info requests that include the x‑ns‑company header, followed by an upgrade to a WebSocket (Upgrade: websocket) on the same host.
Process creation: Unexpected command‑line processes spawned by the web‑application user (e.g., /bin/sh -c patterns).
Threat intel feeds: Subscribe to CISA KEV alerts and the vendor’s advisory channel for any new mitigation guidance.
Detection signatures: Deploy the publicly available Nuclei template:
```
nuclei -t remote-trust-cve-2026-1731.yaml -u <target>
```
Log correlation: Correlate IDS/IPS alerts with authentication logs to spot unauthenticated attempts on the RS/PRA web interface.

Remediation & Mitigation

Patch immediately – apply the vendor advisory (BT26‑02) to all self‑hosted RS and PRA instances.

# Example: download and apply the patch package
curl -O <patch-url>
tar -xzf bt26-02.tar.gz
sudo ./install_patch.sh

If patching is not possible, temporarily disable the affected web service or block inbound traffic to the RS/PRA management ports (default 443/8443) at the perimeter firewall.
Validate configuration – ensure that the get_portal_info endpoint is not exposed to the internet; restrict access to trusted IP ranges.
Follow BOD 22‑01 guidance for cloud services when using BeyondTrust SaaS deployments.
Monitor for the indicators listed above and verify that no new WebSocket sessions are established without proper authentication.

Bottom Line

CVE-2026-1731 is a critical, pre‑authentication remote code execution flaw in BeyondTrust Remote Support and Privileged Remote Access. With a CVSS score of 9.8/9.9, active exploitation in the wild, and inclusion in the CISA KEV catalog, organizations must patch now or isolate the vulnerable service. Continuous monitoring for the described network patterns will help detect any lingering attempts.

References

Vendor advisory (BT26‑02): https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
Proof‑of‑Concept on GitHub: https://github.com/win3zz/CVE-2026-1731
CISA Known Exploited Vulnerabilities catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731
BeyondTrust Knowledge Base article: https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293
GreyNoise analysis: https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731
Real‑time intelligence and signal timeline: https://vulnsocial.com/cve/CVE-2026-1731

#CVE20261731 #Critical #RCE #CISAKEV #BeyondTrust