What is the CVSS score of CVE-2026-1731?

CVE-2026-1731 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 66.1%.

Which versions of Privileged Remote Access are affected by CVE-2026-1731?

BeyondTrust Remote Support and older Privileged Remote Access versions contain a critical pre-authentication vulnerability (CVSS 9.8) that is actively exploited in the wild.

Is there a public PoC exploit available for CVE-2026-1731?

Yes, a public proof-of-concept exploit is available for CVE-2026-1731. Prioritise patching immediately. EPSS: 66.1%.

How to fix or mitigate CVE-2026-1731?

Within 24 hours: Inventory all BeyondTrust RS and PRA deployments, isolate affected systems from external networks if possible, and enable enhanced logging. Within 7 days: Contact BeyondTrust support for guidance, implement network segmentation to restrict access to these systems, and deploy WAF rules to block exploitation attempts. Within 30 days: Develop and execute a migration plan to supported product versions, transition to alternative remote access solutions if patches remain unavailable, and conduct forensic analysis of all systems for breach indicators.

Privileged Remote Access CVE-2026-1731

CRITICAL

OS Command Injection (CWE-78)

2026-02-06 13061848-ea10-403d-bd75-c83a022c2891

RCE Privileged Remote Access Remote Support Beyondtrust

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Added to CISA KEV

Feb 17, 2026 - 13:40 cisa

CISA KEV

PoC Detected

Feb 17, 2026 - 13:40 vuln.today

Public exploit code

CVE Published

Feb 06, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

AnalysisAI

BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability (CVE-2026-1731) that allows unauthenticated attackers to execute OS commands through specially crafted requests. With EPSS 66% and KEV listing with public PoC, this vulnerability is devastating because these products are specifically designed for privileged remote access — compromising them grants attackers access to the most sensitive systems in an organization.

Technical ContextAI

The vulnerability exists in the request processing pipeline before any authentication checks, meaning no credentials are needed. User-supplied input in HTTP requests is incorporated into OS commands without proper sanitization. BeyondTrust RS/PRA products are Privileged Access Management (PAM) solutions — they are the gateway through which administrators and support staff access critical systems. Compromising these products gives attackers access to the same highly privileged sessions and credentials they protect.

RemediationAI

Apply BeyondTrust security update immediately — this is EMERGENCY priority. If patching is delayed, take the appliance offline. Audit all privileged sessions and stored credentials for unauthorized access. Rotate all credentials managed through BeyondTrust. Review session recordings for suspicious activity. Conduct full incident response investigation.