PT-2026-6803 · Beyondtrust · Beyondtrust Remote Support +1

Win3Zz

·

Published

2026-02-06

·

Updated

2026-02-17

·

CVE-2026-1731

CVSS v4.0
9.9
VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L
Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support versions 25.3.1 and earlier BeyondTrust Privileged Remote Access versions 24.3.4 and earlier
Description BeyondTrust Remote Support and Privileged Remote Access contain a critical pre-authentication remote code execution vulnerability (CVE-2026-1731) that allows unauthenticated attackers to execute operating system commands in the context of the site user. Attackers can exploit this flaw by sending specially crafted requests. Active exploitation of this vulnerability has been observed, with attackers extracting data and establishing WebSocket channels to execute commands. Approximately 11,000 instances are exposed, with around 8,500 being on-premises deployments. This vulnerability has been linked to previous attacks by sophisticated threat actors. The vulnerability allows attackers to gain full domain control.
Recommendations BeyondTrust Remote Support versions 25.3.1 and earlier: Upgrade to version 25.3.2 or later. BeyondTrust Privileged Remote Access versions 24.3.4 and earlier: Upgrade to version 25.1.1 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-1731

Affected Products

Beyondtrust Remote Support
Privileged Remote Access