CVE-2026-1731

Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

9.9 CriticalIn KEVPublic exploit

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

93.9%Up 93.4 points since Feb 7, 2026

What each source reports

CVE List Score used 9.9

Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

Record: CVE-2026-1731
CVSS 4.0: 9.9 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2026-5559 9.9

Record: EUVD-2026-5559
CVSS 4.0: 9.9 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p5wr-5p37-2wm6 9.9

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA)...

Record: GHSA-p5wr-5p37-2wm6
CVSS 4.0: 9.9 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

CISA KEV No score

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.

Record: CVE-2026-1731
Weakness: CWE-78
Updated: 2026-11-02

NVD 9.9

Record: CVE-2026-1731
CVSS 4.0: 9.9 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution	2026-02-06
PoC in GitHub	win3zz/CVE-2026-1731	2026-02-11
PoC in GitHub	cybrdude/cve-2026-1731-scanner	2026-02-13
PoC in GitHub	jakubie07/CVE-2026-1731	2026-02-18
PoC in GitHub	hex0user/CVE-2026-1731	2026-02-22
PoC in GitHub	ridhinva/beyondtrust-rce-scanner	2026-05-22
Nuclei	BeyondTrust Remote Support - Unauthenticated WebSocket RCE

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-1731 is a critical vulnerability (CVSS 9.9) in Beyondtrust Privileged Remote Access, published February 6, 2026. CISA lists it as known to be exploited, since February 13, 2026. EUVD reports exploitation since February 13, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 93.9%, the 99th percentile. No source names a fixed version.