PT-2026-6803 · Beyondtrust · Beyondtrust Remote Support+1

Win3Zz · Published 2026-01-31 · Updated 2026-04-21 · CVE-2026-1731

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support versions prior to 25.3.2 and Privileged Remote Access versions prior to 25.1.1

Description BeyondTrust Remote Support and Privileged Remote Access software contain a critical pre-authentication remote code execution (RCE) vulnerability (CVE-2026-1731). This vulnerability allows unauthenticated attackers to execute arbitrary operating system commands on affected systems. The vulnerability stems from a flaw in the handling of HTTP requests, specifically within the “thin-scc-wrapper” component. Attackers can exploit this flaw by sending specially crafted requests, enabling them to gain control of the system without needing to log in. Active exploitation of this vulnerability has been observed, with attackers deploying web shells, backdoors (such as VShell and SparkRAT), and staging data for exfiltration. The vulnerability has a CVSS score of 9.9, indicating its critical severity. Approximately 11,000 instances are estimated to be exposed, with a significant number being on-premises deployments. Exploitation has been linked to ransomware campaigns and has been observed across multiple sectors, including finance, healthcare, legal, and technology.

Recommendations BeyondTrust Remote Support versions prior to 25.3.2: Upgrade to version 25.3.2 or later. BeyondTrust Privileged Remote Access versions prior to 25.1.1: Upgrade to version 25.1.1 or later. For older versions, upgrade to a more recent version before applying the security patch. If unable to patch immediately, restrict external access to affected systems. Monitor systems for any signs of compromise, including suspicious network activity and unauthorized file modifications.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-03413

CVE-2026-1731

Affected Products

Beyondtrust Remote Support

Privileged Remote Access

References · 368

• 🔥 https://github.com/win3zz/CVE-2026-1731 · Exploit
• 🔥 https://github.com/jakubie07/CVE-2026-1731 · Exploit
• https://beyondtrust.com/trust-center/security-advisories/bt26-02 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1731 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1731 · Security Note
• https://bdu.fstec.ru/vul/2026-03413 · Security Note
• https://twitter.com/shah_sheikh/status/2025910579115008041 · Twitter Post
• https://twitter.com/shah_sheikh/status/2025911183702675477 · Twitter Post
• https://t.me/proxy_bar/3131 · Telegram Post
• https://twitter.com/skocherhan/status/2025080567390257249 · Twitter Post
• https://twitter.com/vuln_tracker/status/2022233058724991026 · Twitter Post
• https://twitter.com/shah_sheikh/status/2020825360464502809 · Twitter Post
• https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293 · Note
• https://twitter.com/DependGuard/status/2023043542633906445 · Twitter Post
• https://twitter.com/dailytechonx/status/2023800117732503868 · Twitter Post