BeyondTrust and CISA Warn of Active Exploitation of Remote Support and Privileged Remote Access Flaw
Take action: Patch your BeyondTrust instances, start patching NOT. Attackers are using public exploit code to target these systems within hours of disclosure. Where possible, isolate all systems from the internet.
Learn More
CISA and BeyondTrust report that threat actors are actively exploiting a critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access products.
The exploited flaw is tracked as CVE-2026-1731 (CVSS score 9.9) - An operating system command injection vulnerability that allows unauthenticated attackers to run arbitrary commands. Attackers abuse the get_portal_info function to extract the x-ns-company value before setting up a WebSocket channel to run operating system commands.
BeyondTrust exploitation began less than 24 hours after a proof-of-concept was released, with 86% of reconnaissance coming from a single VPN-associated IP address in Frankfurt.
The BeyondTrust flaw affects Remote Support versions 21.3 through 25.3.1 and Privileged Remote Access versions 22.1 through 24.X.
BeyondTrust has released patches BT26-02-RS and BT26-02-PRA to resolve the command injection issue. Cloud customers were updated automatically. CISA has set a deadline of required remediation by March 5, 2026.
