Vulnerability-Lookup

CVE-2026-1731 (GCVE-0-2026-1731)

Vulnerability from cvelistv5 – Published: 2026-02-06 21:49 – Updated: 2026-02-26 15:04

CISA KEV EUVD KEV KEVintel KEV

Title

Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

Summary

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Severity

9.9 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

References

5 references

URL	Tags
https://beyondtrustcorp.service-now.com/csm?id=cs…
https://www.beyondtrust.com/trust-center/security…
https://github.com/win3zz/CVE-2026-1731	exploit
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
https://www.greynoise.io/blog/reconnaissance-beyo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
BeyondTrust	Remote Support(RS) & Privileged Remote Access(PRA)	Affected: 0 , ≤ RS 25.3.1 (custom) Affected: 0 , ≤ PRA 24.3.4 (custom)

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 476a306e-2a29-4830-8026-9169841bf88f

Vulnerability ID: CVE-2026-1731

Status: Confirmed

Status Updated: 2026-02-13 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-02-13

Asserted: 2026-02-13

Scope

Notes: KEV entry: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability | Affected: BeyondTrust / Remote Support (RS) and Privileged Remote Access (PRA) | Description: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-02-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): Please adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 ; https://nvd.nist.gov/vuln/detail/CVE-2026-1731

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-78
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Remote Support (RS) and Privileged Remote Access (PRA)
Due Date	2026-02-16
Date Added	2026-02-13
Vendorproject	BeyondTrust
Vulnerabilityname	BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-1731

Created: 2026-02-16 17:38 UTC | Updated: 2026-02-16 17:38 UTC

EUVD KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 90740855-a2b8-4f16-b41e-2dac516da525

Vulnerability ID: CVE-2026-1731

Status: Confirmed

Status Updated: 2026-06-04 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-06-04

Asserted: 2026-06-04

Scope

Notes: Affected: BeyondTrust / Remote Support (RS), Privileged Remote Access (PRA) | Description: Critical pre-authentication RCE vulnerability. | CWEs: CWE-78 | Origin source: NCSC-FI | Notes: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02

Evidence

Type: Csirt Report

Signal: Successful Exploitation

Confidence: 75%

Source: enisa-cnw-kev

Details

Cwes	CWE-78
Euvd	EUVD-2026-5559
Notes	https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
Catalog	ENISA / EU CSIRTs Network (CNW) KEV JSON
Product	Remote Support (RS), Privileged Remote Access (PRA)
Datereported	2026/06/04
Originsource	NCSC-FI
Vendorproject	BeyondTrust
Exploitationtype	-
Vulnerabilityname
Threatactorsexploiting	-

References

Created: 2026-06-04 13:00 UTC | Updated: 2026-06-04 13:00 UTC

KEVintel KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 3093cd27-2fc0-40c0-a402-2a63ddedd8e3

Vulnerability ID: CVE-2026-1731

Status: Confirmed

Status Updated: 2026-06-01 10:51 UTC

Exploited: Yes

Timestamps

First Seen: 2026-06-01

Asserted: 2026-06-01

Scope

Notes: KEVIntel entry: Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | Affected: BeyondTrust / Remote Support(RS) & Privileged Remote Access(PRA) | CVSS: 9.9 (CRITICAL) | EPSS: 0.86091 | Used in malware: yes | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Confirmed Compromise

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
Vendor	BeyondTrust
Product	Remote Support(RS) & Privileged Remote Access(PRA)
Added Date	2026-06-01T10:51:06.572Z
Cvss Score	9.9
Epss Score	0.86091
Cvss Severity	CRITICAL
Epss Percentile	0.99703
Used In Malware	yes
Ahead Of Cisa Kev	`{ "count": 1, "unit": "day" }`
Not Yet In Cisa Kev	False

References

Created: 2026-06-19 12:45 UTC | Updated: 2026-06-19 12:45 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1731",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-14T04:55:25.328322Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-02-13",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T15:04:15.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/win3zz/CVE-2026-1731"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-13T00:00:00.000Z",
            "value": "CVE-2026-1731 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Remote Support(RS) \u0026 Privileged Remote Access(PRA)",
          "vendor": "BeyondTrust",
          "versions": [
            {
              "lessThanOrEqual": "RS 25.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "PRA 24.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eBeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-248",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-248 Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-06T21:49:20.844Z",
        "orgId": "13061848-ea10-403d-bd75-c83a022c2891",
        "shortName": "BT"
      },
      "references": [
        {
          "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article\u0026sysparm_article=KB0023293"
        },
        {
          "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13061848-ea10-403d-bd75-c83a022c2891",
    "assignerShortName": "BT",
    "cveId": "CVE-2026-1731",
    "datePublished": "2026-02-06T21:49:20.844Z",
    "dateReserved": "2026-01-31T23:54:56.922Z",
    "dateUpdated": "2026-02-26T15:04:15.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2026-1731",
      "cwes": "[\"CWE-78\"]",
      "dateAdded": "2026-02-13",
      "dueDate": "2026-02-16",
      "knownRansomwareCampaignUse": "Known",
      "notes": "Please adhere to the vendor\u0027s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 ; https://nvd.nist.gov/vuln/detail/CVE-2026-1731",
      "product": "Remote Support (RS) and Privileged Remote Access (PRA)",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.",
      "vendorProject": "BeyondTrust",
      "vulnerabilityName": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability"
    },
    "epss": {
      "cve": "CVE-2026-1731",
      "date": "2026-06-20",
      "epss": "0.86091",
      "percentile": "0.99702"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-1731\",\"sourceIdentifier\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"published\":\"2026-02-06T22:16:11.020\",\"lastModified\":\"2026-02-17T13:40:10.320\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"cisaExploitAdd\":\"2026-02-13\",\"cisaActionDue\":\"2026-02-16\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability\",\"weaknesses\":[{\"source\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"25.1\",\"matchCriteriaId\":\"A82D26FE-8791-41BC-A71B-4C2FEB81C41C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"25.3.2\",\"matchCriteriaId\":\"178845B4-26D3-4C94-AED9-1C847B9357F1\"}]}]}],\"references\":[{\"url\":\"https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article\u0026sysparm_article=KB0023293\",\"source\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://www.beyondtrust.com/trust-center/security-advisories/bt26-02\",\"source\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/win3zz/CVE-2026-1731\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]},{\"url\":\"https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-1731\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-14T00:18:31.196840Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2026-02-13\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731\"}}}], \"references\": [{\"url\": \"https://github.com/win3zz/CVE-2026-1731\", \"tags\": [\"exploit\"]}, {\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731\", \"tags\": [\"government-resource\"]}, {\"url\": \"https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731\", \"tags\": [\"third-party-advisory\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-09T15:01:48.065Z\"}, \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-02-13T00:00:00.000Z\", \"value\": \"CVE-2026-1731 added to CISA KEV\"}]}], \"cna\": {\"title\": \"Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-248\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-248 Command Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.9, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"BeyondTrust\", \"product\": \"Remote Support(RS) \u0026 Privileged Remote Access(PRA)\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"RS 25.3.1\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"PRA 24.3.4\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article\u0026sysparm_article=KB0023293\"}, {\"url\": \"https://www.beyondtrust.com/trust-center/security-advisories/bt26-02\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eBeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u0026nbsp;\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"13061848-ea10-403d-bd75-c83a022c2891\", \"shortName\": \"BT\", \"dateUpdated\": \"2026-02-06T21:49:20.844Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-1731\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-14T05:20:23.748Z\", \"dateReserved\": \"2026-01-31T23:54:56.922Z\", \"assignerOrgId\": \"13061848-ea10-403d-bd75-c83a022c2891\", \"datePublished\": \"2026-02-06T21:49:20.844Z\", \"assignerShortName\": \"BT\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-1731

Vulnerability from fkie_nvd - Published: 2026-02-06 22:16 - Updated: 2026-06-17 10:16

CISA KEV EUVD KEV KEVintel KEV

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
13061848-ea10-403d-bd75-c83a022c2891	https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293	Permissions Required
13061848-ea10-403d-bd75-c83a022c2891	https://www.beyondtrust.com/trust-center/security-advisories/bt26-02	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/win3zz/CVE-2026-1731	Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731	US Government Resource
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731	Third Party Advisory

Impacted products

	Vendor	Product	Version
	beyondtrust	privileged_remote_access	*
	beyondtrust	remote_support	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Remote Support(RS) \u0026 Privileged Remote Access(PRA)",
          "vendor": "BeyondTrust",
          "versions": [
            {
              "lessThanOrEqual": "RS 25.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "PRA 24.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "13061848-ea10-403d-bd75-c83a022c2891"
    }
  ],
  "cisaActionDue": "2026-02-16",
  "cisaExploitAdd": "2026-02-13",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A82D26FE-8791-41BC-A71B-4C2FEB81C41C",
              "versionEndExcluding": "25.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "178845B4-26D3-4C94-AED9-1C847B9357F1",
              "versionEndExcluding": "25.3.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user."
    },
    {
      "lang": "es",
      "value": "BeyondTrust Remote Support (RS) y ciertas versiones anteriores de Privileged Remote Access (PRA) contienen una cr\u00edtica vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de pre-autenticaci\u00f3n. Al enviar solicitudes especialmente dise\u00f1adas, un atacante remoto no autenticado podr\u00eda ejecutar comandos del sistema operativo en el contexto del usuario del sitio."
    }
  ],
  "id": "CVE-2026-1731",
  "lastModified": "2026-06-17T10:16:24.797",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "13061848-ea10-403d-bd75-c83a022c2891",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-1731",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-02-14T04:55:25.328322Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-02-06T22:16:11.020",
  "references": [
    {
      "source": "13061848-ea10-403d-bd75-c83a022c2891",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article\u0026sysparm_article=KB0023293"
    },
    {
      "source": "13061848-ea10-403d-bd75-c83a022c2891",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/win3zz/CVE-2026-1731"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731"
    }
  ],
  "sourceIdentifier": "13061848-ea10-403d-bd75-c83a022c2891",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "13061848-ea10-403d-bd75-c83a022c2891",
      "type": "Secondary"
    }
  ]
}

GHSA-P5WR-5P37-2WM6

Vulnerability from github – Published: 2026-02-07 00:30 – Updated: 2026-02-17 15:31

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-1731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-06T22:16:11Z",
    "severity": "CRITICAL"
  },
  "details": "BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.",
  "id": "GHSA-p5wr-5p37-2wm6",
  "modified": "2026-02-17T15:31:33Z",
  "published": "2026-02-07T00:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1731"
    },
    {
      "type": "WEB",
      "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article\u0026sysparm_article=KB0023293"
    },
    {
      "type": "WEB",
      "url": "https://github.com/win3zz/CVE-2026-1731"
    },
    {
      "type": "WEB",
      "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731"
    },
    {
      "type": "WEB",
      "url": "https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

NCSC-2026-0048

Vulnerability from csaf_ncscnl - Published: 2026-02-09 10:27 - Updated: 2026-02-13 12:54

Summary

Kwetsbaarheid verholpen in BeyondTrust Remote Support

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten: BeyondTrust heeft een kwetsbaarheid verholpen in BeyondTrust Remote Support en enkele oudere versies van Privileged Remote Access.

Interpretaties: De kwetsbaarheid bevindt zich in de pre-authenticatie van de software, waardoor niet-geauthenticeerde aanvallers in staat zijn om besturingssysteemcommando's uit te voeren door speciaal vervaardigde verzoeken naar de getroffen systemen te sturen. **Update 13 02 2026:** Voor de kwetsbaarheid CVE-2026-1731 is recentelijk publieke proof-of-concept code verschenen en ook actief misbruik waargenomen. Deze factoren verhogen aanzienlijk het risico op misbruik.

Oplossingen: BeyondTrust heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans: high

Schade: high

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2026-1731

A critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and older versions of Privileged Remote Access allows unauthenticated attackers to execute OS commands via specially crafted requests.

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* BeyondTrust / Remote Support		vers:unknown/*

References

2 references

URL	Category
https://www.beyondtrust.com/trust-center/security…	external
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "BeyondTrust heeft een kwetsbaarheid verholpen in BeyondTrust Remote Support en enkele oudere versies van Privileged Remote Access.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid bevindt zich in de pre-authenticatie van de software, waardoor niet-geauthenticeerde aanvallers in staat zijn om besturingssysteemcommando\u0027s uit te voeren door speciaal vervaardigde verzoeken naar de getroffen systemen te sturen.\n\n**Update 13 02 2026:**\nVoor de kwetsbaarheid CVE-2026-1731 is recentelijk publieke proof-of-concept code verschenen en ook actief misbruik waargenomen. Deze factoren verhogen aanzienlijk het risico op misbruik.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "BeyondTrust heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
        "title": "CWE-78"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"
      }
    ],
    "title": "Kwetsbaarheid verholpen in BeyondTrust Remote Support",
    "tracking": {
      "current_release_date": "2026-02-13T12:54:32.614217Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0048",
      "initial_release_date": "2026-02-09T10:27:57.867529Z",
      "revision_history": [
        {
          "date": "2026-02-09T10:27:57.867529Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        },
        {
          "date": "2026-02-13T12:54:32.614217Z",
          "number": "1.0.1",
          "summary": "Voor de kwetsbaarheid CVE-2026-1731 is recentelijk publieke proof-of-concept code verschenen en ook actief misbruik waargenomen. Deze factoren verhogen aanzienlijk het risico op misbruik."
        }
      ],
      "status": "final",
      "version": "1.0.1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Remote Support"
          }
        ],
        "category": "vendor",
        "name": "BeyondTrust"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1731",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
          "title": "CWE-78"
        },
        {
          "category": "description",
          "text": "A critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and older versions of Privileged Remote Access allows unauthenticated attackers to execute OS commands via specially crafted requests.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-1731 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-1731.json"
        }
      ],
      "title": "CVE-2026-1731"
    }
  ]
}

WID-SEC-W-2026-0331

Vulnerability from csaf_certbund - Published: 2026-02-05 23:00 - Updated: 2026-02-25 23:00

Summary

BeyondTrust Privileged Remote Access und Remote Support: Schwachstelle ermöglicht Codeausführung

Severity

Kritisch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: BeyondTrust Privileged Remote Access (PRA) bietet privilegierten Benutzern und externen Anbietern sicheren, überwachten Zugriff auf kritische Systeme und IT-Infrastrukturen. BeyondTrust Remote Support (RS) ermöglicht IT-Teams und Dienstleistern sicheren, interaktiven Fernzugriff zur Unterstützung von Endbenutzern

Angriff: Ein Angreifer kann eine Schwachstelle in BeyondTrust Privileged Remote Access und BeyondTrust Remote Support ausnutzen, um Code auszuführen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-1731

Affected products

Known affected 3 products

Product	Identifier	Version	Remediation
BeyondTrust Remote Support <25.3.2 BeyondTrust / Remote Support		<25.3.2
BeyondTrust Privileged Remote Access <24.3.5 BeyondTrust / Privileged Remote Access		<24.3.5
BeyondTrust Remote Support <23.2.7 BeyondTrust / Remote Support		<23.2.7

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://beazley.security/alerts-advisories/critic…	external
https://beyondtrustcorp.service-now.com/csm?id=cs…	external
https://www.beyondtrust.com/trust-center/security…	external
https://docs.beyondtrust.com/rs/changelog/remote-…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "BeyondTrust Privileged Remote Access (PRA) bietet privilegierten Benutzern und externen Anbietern sicheren, \u00fcberwachten Zugriff auf kritische Systeme und IT-Infrastrukturen.\r\nBeyondTrust Remote Support (RS) erm\u00f6glicht IT-Teams und Dienstleistern sicheren, interaktiven Fernzugriff zur Unterst\u00fctzung von Endbenutzern",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann eine Schwachstelle in BeyondTrust Privileged Remote Access und BeyondTrust Remote Support ausnutzen, um Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0331 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0331.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0331 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0331"
      },
      {
        "category": "external",
        "summary": "beazley security Advisory vom 2026-02-05",
        "url": "https://beazley.security/alerts-advisories/critical-vulnerability-in-beyond-trust-remote-support-and-privileged-remote-access-products"
      },
      {
        "category": "external",
        "summary": "BeyondTrust KnowledgeBase Artikel",
        "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article\u0026sysparm_article=KB0023293"
      },
      {
        "category": "external",
        "summary": "BeyondTrust Security Advisory vom 2026-02-06",
        "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"
      },
      {
        "category": "external",
        "summary": "BeyondTrust Remote Support 23.2.7 Release Notes vom 2026-02-25",
        "url": "https://docs.beyondtrust.com/rs/changelog/remote-support-23-2-7-release-notes"
      }
    ],
    "source_lang": "en-US",
    "title": "BeyondTrust Privileged Remote Access und Remote Support: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2026-02-25T23:00:00.000+00:00",
      "generator": {
        "date": "2026-02-26T06:57:13.022+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0331",
      "initial_release_date": "2026-02-05T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-02-05T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-02-08T23:00:00.000+00:00",
          "number": "2",
          "summary": "CVE erg\u00e4nzt"
        },
        {
          "date": "2026-02-09T23:00:00.000+00:00",
          "number": "3",
          "summary": "CVSS vom Hersteller \u00fcbernommen"
        },
        {
          "date": "2026-02-12T23:00:00.000+00:00",
          "number": "4",
          "summary": "Exploit aufgenommen"
        },
        {
          "date": "2026-02-25T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von BeyondTrust aufgenommen"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c24.3.5",
                "product": {
                  "name": "BeyondTrust Privileged Remote Access \u003c24.3.5",
                  "product_id": "T050580"
                }
              },
              {
                "category": "product_version",
                "name": "24.3.5",
                "product": {
                  "name": "BeyondTrust Privileged Remote Access 24.3.5",
                  "product_id": "T050580-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:beyondtrust:privileged_remote_access:24.3.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Privileged Remote Access"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c25.3.2",
                "product": {
                  "name": "BeyondTrust Remote Support \u003c25.3.2",
                  "product_id": "T050581"
                }
              },
              {
                "category": "product_version",
                "name": "25.3.2",
                "product": {
                  "name": "BeyondTrust Remote Support 25.3.2",
                  "product_id": "T050581-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:beyondtrust:remote_support:25.3.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c23.2.7",
                "product": {
                  "name": "BeyondTrust Remote Support \u003c23.2.7",
                  "product_id": "T051179"
                }
              },
              {
                "category": "product_version",
                "name": "23.2.7",
                "product": {
                  "name": "BeyondTrust Remote Support 23.2.7",
                  "product_id": "T051179-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:beyondtrust:remote_support:23.2.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Remote Support"
          }
        ],
        "category": "vendor",
        "name": "BeyondTrust"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1731",
      "product_status": {
        "known_affected": [
          "T050581",
          "T050580",
          "T051179"
        ]
      },
      "release_date": "2026-02-05T23:00:00.000+00:00",
      "title": "CVE-2026-1731"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-1731 (GCVE-0-2026-1731)

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

EUVD KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Csirt Report Successful Exploitation Confidence: 75% Source: enisa-cnw-kev

Details

References

KEVintel KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Confirmed Compromise Confidence: 70% Source: kevintel

Details

References

FKIE_CVE-2026-1731

GHSA-P5WR-5P37-2WM6

NCSC-2026-0048

WID-SEC-W-2026-0331

Tags

Sightings

Nomenclature