CVEs / CVE-2026-1731
CVE-2026-1731: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
- Known exploited in the CISA KEV catalog since 13 Feb 2026
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 93.1% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-1731
Summary
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
Description
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA) | up to and including RS 25.3.1 | — |
| BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA) | up to and including PRA 24.3.4 | — |
Exploitation
| In CISA KEV since | 13 Feb 2026 |
|---|---|
| Due date for US federal agencies | 16 Feb 2026 |
| Used in ransomware campaigns | Known |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-78 |
References
- CVE-2026-1731 on NVD
- CVE-2026-1731 in the CISA KEV catalog
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 (cited by CISA)
- https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293 Permissions Required
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 Vendor Advisory
- https://github.com/win3zz/CVE-2026-1731 Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731 US Government Resource
- https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731 Third Party Advisory
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.