CVE-2026-1731
Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
CVE-2026-1731 is a critical vulnerability (CVSS 9.9) in Beyondtrust Privileged Remote Access, published February 6, 2026. CISA lists it as known to be exploited, since February 13, 2026. EUVD reports exploitation since February 13, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 93.9%, the 99th percentile. No source names a fixed version.
- Severity
- 9.9 CriticalCVSS 4.0, CVE List
- Exploit chance
- 93.9%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution | 2026-02-06 |
| PoC in GitHub | win3zz/CVE-2026-1731 | 2026-02-11 |
| PoC in GitHub | cybrdude/cve-2026-1731-scanner | 2026-02-13 |
| PoC in GitHub | jakubie07/CVE-2026-1731 | 2026-02-18 |
| PoC in GitHub | hex0user/CVE-2026-1731 | 2026-02-22 |
| PoC in GitHub | ridhinva/beyondtrust-rce-scanner | 2026-05-22 |
| Nuclei | BeyondTrust Remote Support - Unauthenticated WebSocket RCE |
What each source reports
CVE List Score used
Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
- Record
CVE-2026-1731- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-5559
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
- Record
EUVD-2026-5559- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p5wr-5p37-2wm6
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA)...
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
- Record
GHSA-p5wr-5p37-2wm6- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
CISA KEVNo score
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
- Record
CVE-2026-1731- Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
- Record
CVE-2026-1731- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293
beyondtrust.com/trust-center/security-advisories/bt26-02
github.com/win3zz/CVE-2026-1731
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731
greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731
nvd.nist.gov/vuln/detail/CVE-2026-1731