CVE-2024-12356Active Exploitation(beyondtrust / privileged_remote_access)

🚨 A critical pre-auth RCE has been disclosed in BeyondTrust Remote Support and PRA (CVE-2026-1731, CVSS 9.9) Our intel suggests this is another websocket vuln, similar to CVE-2024-12356 🍯We have added a BeyondTrust RS honeypot stream for Defused TF 👉 https://console.defusedcyber.com/signup https://t.co/6iVgqRgbKz

CVE-2024-12356: Command injection in BeyondTrust PRA/RS lets unauthenticated attackers run commands as a site user; CISA added CVE-2024-12356 to KEV with rapid remediation due.

#threatreport #HighCompleteness VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) | 20-02-2026 Source: https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/ Key details below ↓ 🧑‍💻Actors/Campaigns: Hafnium Emissary_panda Quietcrabs 💀Threats: Vshell, Spark_rat, Beyondtrust_tool, Simplehelp_tool, Anydesk_tool, Chinachopper, Antsword, Nezha_tool, Metasploit_tool, Meterpreter_tool, Bomgar_tool, Ncat_tool, Netcat_tool, Socat_tool, 🎯Victims: Identity and access management, Remote support software users 🏭Industry: Education, Iot, Retail, Healthcare 🌐Geo: China, India, Germany, Canada, France, Asia, Middle east, Korea, Japan, Australia 🔓CVEs: CVE-2026-1731 \[[Vulners](https://vulners.com/cve/CVE-2026-1731)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - beyondtrust privileged_remote_access (<25.1) - beyondtrust remote_support (<25.3.2) CVE-2024-12356 \[[Vulners](https://vulners.com/cve/CVE-2024-12356)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - beyondtrust privileged_remote_access (le24.3.1) - beyondtrust remote_support (le24.3.1) 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 1 🧨IOCs: - File: 23 - Domain: 3 - IP: 16 - Url: 16 - Hash: 9 💽Software: Unix, Linux, curl, busybox, Burp Suite, PostgreSQL, crontab 🔢Algorithms: base64 🔠Functions: eval 📜Programming Languages: powershell, php, java, lua, python 💻Platforms: cross-platform #threatreport: CVE-2026-1731 is a critical remote code execution (RCE) vulnerability identified in BeyondTrust's remote support software, particularly affecting the thin-scc-wrapper component. Discovered on February 6, 2026, this vulnerability allows attackers to execute operating system commands in the context of the affected site's user, potentially leading to significant system compromises such as unauthorized access, data exfiltration, and service disruptions. The exploitation of CVE-2026-1731 occurs through a sanitization failure during the WebSocket connection handshake. Attackers initiate a WebSocket connection to specific endpoints, supplying a crafted 'remoteVersion' value that carries an injected payload. This payload is designed to trigger the execution of a shell command due to improper handling of the input by the thin-scc-wrapper script. Active investigations by Unit 42 have revealed that threat actors are effectively exploiting this vulnerability to gain unauthorized access to administrative accounts within affected systems. Attackers are employing a custom Python script for temporary access to an administrative account (User ID 1) for sixty seconds, allowing them to manipulate password hashes in the database. Additionally, multiple web shells have been installed on compromised systems, including a PHP web shell that allows attackers to execute commands and perform various post-exploitation activities without leaving significant traces. Moreover, the SparkRAT backdoor has been observed linked to these attacks. Initially identified during 2023, SparkRAT is a cross-platform remote access Trojan (RAT) that has been in use since 2022. Its cross-platform capabilities enable threat actors to maintain persistent access across various environments. To evade detection and prevent response from network defenses, attackers have utilized DNS tunneling via out-of-band techniques. This method effectively allows the exfiltration of sensitive information, including system databases and configuration files, to compromised command and control (C2) servers while bypassing traditional network firewalls. The issue of input validation, which is central to CVE-2026-1731, has historical significance when compared to CVE-2024-12356, underscoring a recurring challenge in securing the execution pathways in BeyondTrust products. This ongoing exploitation highlights the necessity for organizations to promptly patch vulnerabilities to mitigate the risk of such attacks. The activities identified around CVE-2026-1731 represent a serious threat landscape for organizations using unpatched versions of BeyondTrust's technology.

🚨 CVE-2024-12356 : BEYONDTRUST REMOTE SUPPORT PRE-AUTH COMMAND INJECTION RCE ALERT 🚨 BeyondTrust A critical unauthenticated remote code execution vulnerability has been disclosed in BeyondTrust Remote Support and Privileged Remote Access, allowing attackers to execute OS commands by abusing the authentication pipeline. Public proof-of-concept is available and active exploitation is trending. Risk Severity: Critical (unauthenticated RCE, public PoC, ransomware-attractive attack surface, immediate patching required) Impact: • Full remote compromise of BeyondTrust PRA/RS appliances • Unauthorized access to internal networks via trusted remote access gateway • Harvesting of stored privileged credentials • Lateral movement to hundreds of downstream systems • Persistent backdoor installation on appliance and managed hosts • Enterprise-wide ransomware deployment and data exfiltration Root Cause: CWE-78 (OS Command Injection) Improper sanitization of attacker-controlled input in authentication and session handling workflows allows direct OS command execution via crafted HTTP requests. Attackers can: • Send unauthenticated crafted HTTP requests to authentication endpoints • Inject command payloads into authentication parameters • Execute arbitrary OS commands with site user privileges • Gain persistent control of the remote access appliance • Pivot into internal enterprise infrastructure Are You Affected? Vulnerable: • BeyondTrust Remote Support v23.x, v24.x prior to fixed releases Fixed in: • v24.02.001 (appliance) • v24.2.1 and later (cloud-hosted) Immediate Action Required: Update/Patch: • Upgrade immediately to v24.02.001+ (appliance) or v24.2.1+ (cloud) and verify the running build Mitigation (if you cannot patch within hours): • Disconnect all internet-facing appliances from public access • Enforce VPN-only administration • Apply strict IP allowlisting • Deploy WAF rules blocking command injection patterns Audit & Monitor: • Review authentication logs for URL-encoded command characters • Monitor for anomalous child processes spawned by authentication daemons • Watch for suspicious outbound connections • Review audit logs for unauthorized session creation Incident Response: • If exposed and exploitation is suspected, isolate the appliance, preserve forensic artifacts, rotate all privileged credentials, audit all recent sessions, and assume lateral movement occurred Given BeyondTrust’s privileged position inside enterprise networks, this unauthenticated RCE is a network-wide blast-radius event, patch immediately and assume compromise if exposure existed. 🛡️ #ostorlabCVE

https://research.lyrie.ai/research/active-exploit-cve-2024-12356-privileged-remote-access-pra-and-remote-support-rs #lyrie #cybersecurity #CVE #threatintel #zerodayattack

#threatreport #MediumCompleteness CVE-2026-1731: Finding a critical RCE in an age of AI-driven vulnerability research | 06-03-2026 Source: https://www.intel471.com/blog/cve-2026-1731-finding-a-critical-rce-in-an-age-of-ai-driven-vulnerability-research Key details below ↓ 🧑‍💻Actors/Campaigns: Hafnium 💀Threats: Simplehelp_tool, Impacket_tool, Interactsh_tool, 🎯Victims: Government, Federal agencies, Beyondtrust customers 🌐Geo: Chinese 🔓CVEs: CVE-2026-1731 \[[Vulners](https://vulners.com/cve/CVE-2026-1731)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - beyondtrust privileged_remote_access (<25.1) - beyondtrust remote_support (<25.3.2) CVE-2024-12356 \[[Vulners](https://vulners.com/cve/CVE-2024-12356)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - beyondtrust privileged_remote_access (le24.3.1) - beyondtrust remote_support (le24.3.1) 🤖LLM extracted TTPs:` T1021.002, T1036, T1046, T1059, T1059.001, T1059.004, T1071.001, T1102, T1105, T1190, ... 🧨IOCs: - File: 2 - Url: 3 - Hash: 3 - Domain: 7 - IP: 4 💽Software: Claude, Active Directory, PsExec 📜Programming Languages: python, powershell 💻Platforms: intel #threatreport: CVE-2026-1731 is a critical operating system command injection vulnerability affecting BeyondTrust Remote Support and Privileged Remote Access software, which are essential for managing privileged user access. Discovered on January 31, 2026, by the Hacktron vulnerability hunter through AI-enabled analysis, this vulnerability allows unauthenticated remote attackers to execute arbitrary OS commands, potentially resulting in full system compromise and data exfiltration. The flaw is rooted in a Bash script, "thin-scc-wrapper," which processes the "remoteVersion" parameter during client-server negotiations via the vulnerable /nw WebSocket endpoint. Notably, the vulnerability can be exploited without authentication, requiring only a valid X-Ns-Company HTTP header that matches the target system's configuration. Exploitation activity started shortly after the vulnerability's disclosure, with a proof of concept appearing on GitHub just four days later. This expediency reflects the vulnerability's straightforward nature, enabling rapidly developed exploits, including those using the websocat tool for interaction with the vulnerable WebSocket endpoint. Although exploits were primarily noted to use benign commands like "nslookup," they could easily be adapted to perform more harmful actions, such as reading sensitive files or executing remote shells. Following its addition to CISA's Known Exploited Vulnerabilities catalog shortly after disclosure, CVE-2026-1731 exhibited increased scanning activity, with reports from security researchers marking its attention from threat actors, including an initial access broker on a Russian-language cybercrime forum. The vulnerability’s attractiveness to adversaries stems from BeyondTrust's extensive deployment and lack of authentication requirements, resulting in a high CVSSv4 score of 9.9 due to significant risks to system confidentiality, integrity, and availability. To exploit this vulnerability, attackers can manipulate the target environment by sending specially crafted messages that leverage the vulnerable arithmetic evaluation logic within the affected script. Additionally, various operational techniques have been observed following initial exploitations, including deploying remote monitoring tools like SimpleHelp for persistence within compromised environments and utilizing PowerShell for Active Directory enumeration. The landscape for vulnerability research is shifting with new AI-powered tools augmenting the discovery process, though these advancements present both vulnerabilities and challenges. Organizations are advised to prioritize timely remediation of such vulnerabilities to mitigate risks associated with their exploitation.

Recent reporting by Help Net Security highlights a critical escalation in cyber conflict dynamics as attackers exploit a newly patched remote code execution vulnerability in BeyondTrust software. The flaw, CVE-2026-1731, shares technical similarities with CVE-2024-12356—a zero-day previously weaponized by Chinese state-sponsored actors to breach U.S. government infrastructure. This pattern underscores persistent geopolitical tensions between nation-state adversaries and their exploitation of software supply chains to advance strategic objectives. The current campaign involves probing non-standard ports and leveraging reconnaissance tools like Nuclei scripts, suggesting a coordinated effort to identify and compromise vulnerable systems. While no single nation-state has been explicitly attributed to the recent activity, the technical overlap with prior Chinese operations and the focus on BeyondTrust—a tool widely used in critical infrastructure sectors—point to ongoing efforts to exploit geopolitical fault lines through cyber means. The rapid exploitation of this patched vulnerability introduces significant operational risks for small and medium enterprises reliant on BeyondTrust for remote access management. SMEs face immediate pressure to apply patches, which may disrupt workflows if not executed carefully. Additionally, the surge in scanning activity targeting unconventional ports indicates attackers are adapting to common defensive practices like security-through-obscurity, forcing businesses to reassess their network segmentation strategies. For organizations with limited IT resources, the financial burden of emergency remediation, coupled with potential insurance premium increases due to heightened exposure, could strain budgets. Regulatory compliance also becomes a concern, particularly for businesses in sectors with strict data protection mandates, as unpatched systems may violate requirements for timely vulnerability management. Technical analysis reveals that CVE-2026-1731 allows unauthenticated attackers to execute arbitrary commands via the getportalinfo endpoint, a flaw that mirrors the attack surface exploited in 2024. Researchers have already published proof-of-concept code, lowering the barrier for less sophisticated threat actors to deploy this exploit. The observed reconnaissance patterns—focusing on non-standard ports—suggest attackers are leveraging knowledge of enterprise hardening practices to bypass basic defenses. This highlights a broader trend of adversaries refining their tactics to exploit predictable human behaviors in cybersecurity, such as the tendency to obscure services behind non-default configurations. To mitigate this threat, SMEs should immediately verify their BeyondTrust instances are updated to the latest patched version and restrict access to these systems using strict network firewall rules. Specifically, configure firewalls to allow connections only from pre-approved IP ranges and disable unnecessary ports. Additionally, enable multi-factor authentication for administrative access and monitor logs for anomalous WebSocket activity. These steps reduce the attack surface while providing time to implement more comprehensive long-term solutions. https://www.helpnetsecurity.com/2026/02/13/beyondtrust-cve-2026-1731-poc-exploit-activity/ #CVE20261731 #CVE202412356 #DataBreach #ZeroDay #Vulnerability

#threatreport #LowCompleteness Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far | 12-02-2025 Source: https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731 Key details below ↓ 🧑‍💻Actors/Campaigns: Hafnium 💀Threats: Beyondtrust_tool, Log4shell_vuln, Simplehelp_tool, 🎯Victims: Beyondtrust customers, Enterprise networks 🏭Industry: Government, Iot 🌐Geo: Polish, Chinese 🔓CVEs: CVE-2025-1094 \[[Vulners](https://vulners.com/cve/CVE-2025-1094)] - CVSS V3.1: *8.1*, - Vulners: Exploitation: True CVE-2026-1731 \[[Vulners](https://vulners.com/cve/CVE-2026-1731)] - CVSS V3.1: *9.9*, - Vulners: Exploitation: Unknown CVE-2024-12356 \[[Vulners](https://vulners.com/cve/CVE-2024-12356)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - beyondtrust privileged_remote_access (le24.3.1) - beyondtrust remote_support (le24.3.1) 🤖LLM extracted TTPs:` T1046, T1078, T1090, T1110, T1190, T1590, T1595, T1595.001 🧨IOCs: - IP: 1 💽Software: Slack, Linux, MOVEit, PostgreSQL #threatreport: CVE-2026-1731 represents a significant security vulnerability in BeyondTrust Remote Support and Privileged Remote Access servers, characterized as an OS command injection flaw with a high severity score of 9.9 (CVSS v4). The vulnerability allows unauthenticated attackers to execute arbitrary commands without requiring user interaction, making it particularly easy to exploit due to its low complexity. Recent reconnaissance activities indicate that a single IP address associated with a commercial VPN service has been responsible for approximately 86% of these probing sessions. This identified actor has been active since 2023 and has rapidly incorporated checks for CVE-2026-1731 into its operational toolkit. Interestingly, the reconnaissance is primarily focused on non-standard ports rather than the default port 443, which suggests that the threat actors are aware that many organizations configure BeyondTrust deployments to use alternative ports as a security measure. Technical analysis of the scanning sessions has uncovered JA4+ fingerprints that indicate the use of shared tooling, leveraging VPN tunneling evidenced by distinct network characteristics. The majority of sessions display a Linux stack at the TCP layer, with one dominant scanner reporting a maximum segment size (MSS) of 1358—indicative of VPN encapsulation. Furthermore, the observed HTTP traffic utilizes two different exploit tools: a lightweight version and a more complex variant, neither of which correlate with known applications in existing databases. Additionally, the actors behind these reconnaissance efforts are not exclusively targeting BeyondTrust. Their activity profile suggests they are simultaneously probing for vulnerabilities in a range of other products, including SonicWall, MOVEit Transfer, Log4j, and Sophos firewalls, alongside conducting brute force attacks on SSH and testing for default credentials in IoT devices. Some of these actors employ out-of-band callback techniques to verify vulnerabilities before executing payloads. The involvement of BeyondTrust's remote access tools in managing privileged network access highlights the critical nature of this vulnerability. Successful exploitation could grant attackers substantial access to enterprise networks. The emergence of CVE-2026-1731 follows a recognizable trend: once disclosed, proof of concept (PoC) exploits are quickly developed, leading to swift reconnaissance actions aimed at identifying vulnerable systems. Such patterns have previously resulted in successful breaches, underscoring the urgency for rapid mitigation efforts in the face of this vulnerability.

Recent reporting by Help Net Security highlights a critical remote code execution vulnerability (CVE-2026-1731) in BeyondTrust’s Remote Support and Privileged Remote Access tools, underscoring the persistent role of geopolitical tensions in shaping cybersecurity risks. While this specific flaw was privately disclosed by a researcher and not yet observed in active exploitation, its existence follows a pattern of state-sponsored cyber operations targeting critical infrastructure. In late 2024, a prior BeyondTrust zero-day (CVE-2024-12356) was exploited by China-linked threat actors to breach the U.S. Treasury Department, illustrating how nation-state adversaries weaponize software vulnerabilities to advance strategic objectives. The global competition for technological dominance, particularly between the U.S. and China, fuels a cyberarms race where remote access tools—critical for global IT operations—become prime targets. This context reveals that even privately reported flaws can become geopolitical assets if left unpatched, as adversaries continuously seek to exploit weaknesses in widely used enterprise software. The vulnerability’s impact extends beyond technical risk to disrupt global markets and supply chains, particularly for small and medium-sized enterprises (SMEs) reliant on remote access solutions for operational continuity. Unpatched systems expose organizations to potential data exfiltration, service disruptions, and unauthorized access, all of which could destabilize vendor relationships and erode customer trust. For SMEs with limited cybersecurity resources, the cost of delayed patching may include regulatory penalties, increased insurance premiums, and reputational harm. The dual deployment models of BeyondTrust’s tools—on-premises and cloud-based—mean that businesses of all sizes face uneven exposure, depending on their infrastructure choices. Additionally, the urgency to apply patches may strain IT teams already managing overlapping compliance requirements, highlighting the need for proactive vulnerability management strategies in an era of escalating cyber threats. CVE-2026-1731 is a pre-authentication remote code execution flaw that allows unauthenticated attackers to execute arbitrary commands on vulnerable systems. Unlike the previously exploited zero-day, this vulnerability was identified through responsible disclosure, yet its ease of exploitation—requiring no user interaction—makes it a high-priority target for attackers. BeyondTrust has already applied patches for SaaS customers, but self-hosted implementations remain at risk. The flaw’s potential for system compromise, including data theft and service disruption, aligns with broader trends of adversaries leveraging remote access tools to establish persistent footholds in enterprise networks. Given the interconnected nature of modern supply chains, a successful exploit could cascade across industries, particularly in sectors where remote IT support is integral to operations, such as healthcare, finance, and critical infrastructure. To mitigate risks, SMEs should immediately inventory all instances of BeyondTrust Remote Support and Privileged Remote Access, applying the latest patches provided by the vendor. For organizations using self-hosted deployments, this includes verifying the version number and prioritizing updates for versions 25.3.1 and earlier of Remote Support and 24.3.4 and earlier of Privileged Remote Access. Beyond patching, SMEs should implement network segmentation to isolate critical assets and reduce the attack surface for remote access tools. This step ensures that even if a vulnerability is exploited, lateral movement within the network remains restricted. Combining these actions with continuous monitoring for anomalous activity—such as unexpected command executions or unauthorized access attempts—creates a layered defense against both known and emerging threats. #CVE20261731 #CVE202412356 #DataBreach #ZeroDay #Vulnerability