What is the CVSS score of CVE-2026-1731?

CVE-2026-1731 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 66.1%.

Is there a public PoC exploit available for CVE-2026-1731?

Yes, a public proof-of-concept exploit is available for CVE-2026-1731. Prioritise patching immediately. EPSS: 66.1%.

How to fix or mitigate CVE-2026-1731?

Within 24 hours: Inventory all BeyondTrust RS and PRA deployments, isolate affected systems from external networks if possible, and enable enhanced logging. Within 7 days: Contact BeyondTrust support for guidance, implement network segmentation to restrict access to these systems, and deploy WAF rules to block exploitation attempts. Within 30 days: Develop and execute a migration plan to supported product versions, transition to alternative remote access solutions if patches remain unavailable, and conduct forensic analysis of all systems for breach indicators.

Remote Support CVE-2026-1731

CRITICAL

OS Command Injection (CWE-78)

2026-02-06 13061848-ea10-403d-bd75-c83a022c2891

RCE Privileged Remote Access Remote Support Beyondtrust

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send specially crafted request to vulnerable endpoint
Exploit

Bypass pre-authentication validation
Execution

Trigger command injection in request handler
Impact

Execute arbitrary OS commands as site user

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions — remote unauthenticated exploitation against default configurations of BeyondTrust Remote Support and certain older versions of Privileged Remote Access.
Impact	CVSS 9.8 (Critical). KEV-listed — actively exploited. EPSS 66.1% — very high exploitation probability. Public PoC available. Pre-authentication — no credentials required. PAM product compromise = access to all managed privileged sessions and credentials. This is a keys-to-the-kingdom vulnerability.
Exploit ScenarioDerived	An attacker sends specially crafted HTTP requests to an internet-facing BeyondTrust RS/PRA appliance, injecting OS commands that execute as the site user. From this initial foothold, the attacker can: access all stored credentials in the PAM vault, hijack active privileged sessions to critical infrastructure, install persistent backdoors, and pivot to every system managed through the BeyondTrust platform. This effectively gives the attacker the same access as the organization's most privileged administrators.

Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.

Exploited in the wild (CISA KEV) No patch listed yet 66.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability (CVE-2026-1731) that allows unauthenticated attackers to execute OS commands through specially crafted requests. With EPSS 66% and KEV listing with public PoC, this vulnerability is devastating because these products are specifically designed for privileged remote access — compromising them grants attackers access to the most sensitive systems in an organization.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 9.8

BeyondTrust RS and PRA contain a pre-authentication command injection vulnerability (CWE-78) that allows unauthenticated remote attackers to execute arbitrary OS commands in the context of the site user through crafted HTTP requests.

RemediationAI

Apply BeyondTrust security update immediately — this is EMERGENCY priority. If patching is delayed, take the appliance offline. Audit all privileged sessions and stored credentials for unauthorized access. Rotate all credentials managed through BeyondTrust. Review session recordings for suspicious activity. Conduct full incident response investigation.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the request processing pipeline before any authentication checks, meaning no credentials are needed. User-supplied input in HTTP requests is incorporated into OS commands without proper sanitization. BeyondTrust RS/PRA products are Privileged Access Management (PAM) solutions — they are the gateway through which administrators and support staff access critical systems. Compromising these products gives attackers access to the same highly privileged sessions and credentials they protect.

Know when Remote Support gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Feb 17, 2026 - 13:40 cisa

CISA KEV

PoC Detected

Feb 17, 2026 - 13:40 vuln.today

Public exploit code

CVE Published

Feb 06, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Executive ViewAI

Why It Matters

BeyondTrust Remote Support and older Privileged Remote Access versions contain a critical pre-authentication vulnerability (CVSS 9.8) that is actively exploited in the wild. Attackers can gain complete system control without credentials, affecting any organization using these products for remote access or privileged account management.

Business Impact: Severe

Compensating Controls

Network segmentation—restrict BeyondTrust systems to authorized IP ranges only; implement reverse proxy/WAF with strict request filtering; disable remote access features if business operations permit; require VPN/MFA for all access to BeyondTrust interfaces; monitor and log all connection attempts; consider air-gapping affected systems until patched. Contact BeyondTrust PSIRT for vendor-specific mitigation guidance as patches are released.

Threat Intelligence Overview

Threat Score

6.9/10

Composite threat intelligence

EPSS Score

66.1%

Top 2% exploitable

EUVD KEV

Listed

EU Exploited Vulnerability

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS POC (2) CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 66.1%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + in CISA KEV (actively exploited), no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

200

Low Medium High Critical

KEV: +50

EPSS: +66

CVSS: +49

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*

cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*

More in Remote Support

View all

CVE-2026-102764 CRITICAL Emergency POC

9.3 Oct 15

BeyondTrust Remote Support appliances contain an authentication bypass (CWE-290) in internal components that fail to val

CVE-2015-0935 HIGH Act Now POC

7.5 May 25

Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to

CVE-2024-12356 CRITICAL Emergency POC

9.8 Dec 17

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which ca

CVE-2025-5309 CRITICAL Act Now

9.8 Jun 16

Server-Side Template Injection (SSTI) vulnerability in the chat feature of Citrix Remote Support (RS) and Privileged Rem

CVE-2023-4310 CRITICAL Act Now

9.8 Sep 05

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injectio

CVE-2026-40139 CRITICAL Act Now

9.2 Jul 06

Authentication bypass in BeyondTrust Remote Support (and the related Privileged Remote Access product) lets an unauthent

CVE-2026-40138 CRITICAL Act Now POC

9.2 Jul 06

Pre-authentication access-control bypass in BeyondTrust Remote Support and Privileged Remote Access appliances lets a ne

CVE-2026-40140 HIGH This Week

8.7 Jul 06

Denial-of-service in BeyondTrust Remote Support and Privileged Remote Access appliances lets an unauthenticated remote a

CVE-2026-40141 HIGH This Week

8.5 Jul 06

Improper data-query neutralization (NoSQL injection) in the web application component of BeyondTrust Remote Support and

CVE-2017-5996 HIGH This Week

7.8 Oct 26

The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijac

CVE-2024-12686 HIGH This Week

7.2 Dec 18

A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacke

Same weakness CWE-78 – OS Command Injection

View all

CVE-2019-15107 CRITICAL POC

9.8

CVE-2024-51378 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

CVE-2018-11138 CRITICAL POC

9.8

CVE-2014-6278 HIGH POC

8.8

CVE-2020-9054 CRITICAL POC

9.8

CVE-2017-6334 HIGH POC

8.8

CVE-2024-50603 CRITICAL POC

10.0

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

References

Advisories & patches

ADVISORY https://vuldb.com/vuln/344810 ADVISORY https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 REF https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731 REF https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back