{"id":"CVE-2026-1731","published":"2026-02-06T22:16:11Z","modified":"2026-06-17T10:16:24Z","title":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability","vendor":"BeyondTrust","product":"Remote Support (RS) and Privileged Remote Access (PRA)","tier":"core","eol":null,"description":{"text":"BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.","provenance":"source","from":"NVD"},"summary":{"text":"BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain an OS command injection flaw, classified as improper neutralization of special elements used in an OS command. An unauthenticated remote attacker who sends specially crafted requests may be able to execute operating system commands in the context of the site user, without any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:06Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.931,"percentile":0.99833,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-02-13","dueDate":"2026-02-16","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 ; https://nvd.nist.gov/vuln/detail/CVE-2026-1731","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-02-09","exploitedFirstSeen":"2026-02-09","ransomware":true,"evidence":[{"url":"https://arcticwolf.com/resources/blog/cve-2026-1731/","date":"2026-02-09"},{"url":"https://x.com/DefusedCyber/status/2022044978697125892","date":"2026-02-12"},{"url":"https://x.com/ethicalhack3r/status/2021870311377879136","date":"2026-02-12"},{"url":"https://arcticwolf.com/resources/blog/update-arctic-wolf-observes-threat-campaign-targeting-beyondtrust-remote-support-following-cve-2026-1731-poc-availability/","date":"2026-02-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-02-13"},{"url":"https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/","date":"2026-02-19"},{"url":"https://www.labs.greynoise.io/grimoire/2026-02-20-weekly-oast-report/","date":"2026-02-22"},{"url":"https://ctrlaltintel.com/threat%20research/MuddyWater/","date":"2026-03-04"},{"url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape","date":"2026-03-12"},{"url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab","date":"2026-03-16"}],"evidenceTotal":27,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild","url":"https://otx.alienvault.com/pulse/6ad9e59054fad0d59ecf53a7","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293","tags":["Permissions Required"]},{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-02","tags":["Vendor Advisory"]},{"url":"https://github.com/win3zz/CVE-2026-1731","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731","tags":["US Government Resource"]},{"url":"https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731","tags":["Third Party Advisory"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote exploit of exposed application.","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"By sending specially crafted requests, an unauthenticated remote attacker","start":168,"end":241}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Direct OS command execution as site user.","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may be able to execute operating system commands in the context of the site user","start":242,"end":322}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-6456fe61781512dde412","title":"MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","publisher":"ctrlaltintel.com","url":"https://ctrlaltintel.com/research/MuddyWater/","date":"2026-03-04","mentions":[{"quote":"CVE-2026-1731 - BeyondTrust RCE","start":3954,"end":3985}]},{"id":"SRC-733f5480456da2725571","title":"#StopRansomware: Medusa Ransomware","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a","date":null,"mentions":[{"quote":"18, 2026) BeyondTrust vulnerability CVE-2026-1731 [CWE-78: OS Command Injection].","start":5080,"end":5161},{"quote":"18, 2026) BeyondTrust vulnerability CVE-2026-1731 [CWE-78: OS Command Injection].","start":5499,"end":5580},{"quote":"Medusa actors leverage vulnerability announcements, such as the February 2026 publication of BeyondTrust vulnerability CVE-2026-1731, to identify CVEs to exploit.","start":5856,"end":6018}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-5559","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5559","exploited":true,"exploitedSince":"2026-02-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2026-02-11","earliestUrl":"https://github.com/win3zz/CVE-2026-1731","repos":[{"name":"win3zz/CVE-2026-1731","url":"https://github.com/win3zz/CVE-2026-1731","stars":37,"created":"2026-02-11"},{"name":"jakubie07/CVE-2026-1731","url":"https://github.com/jakubie07/CVE-2026-1731","stars":6,"created":"2026-02-18"},{"name":"cybrdude/cve-2026-1731-scanner","url":"https://github.com/cybrdude/cve-2026-1731-scanner","stars":4,"created":"2026-02-13"},{"name":"hex0user/CVE-2026-1731","url":"https://github.com/hex0user/CVE-2026-1731","stars":1,"created":"2026-02-22"},{"name":"ridhinva/beyondtrust-rce-scanner","url":"https://github.com/ridhinva/beyondtrust-rce-scanner","stars":0,"created":"2026-05-22"}]},"metasploit":[{"name":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution","module":"exploit/linux/http/beyondtrust_pra_rs_command_injection","type":"exploit","disclosureDate":"2026-02-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb"}],"nuclei":[{"id":"CVE-2026-1731","name":"BeyondTrust Remote Support - Unauthenticated WebSocket RCE","severity":"critical","path":"javascript/cves/2026/CVE-2026-1731.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-1731.yaml"}],"first":{"date":"2026-02-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb"},"provenance":"source"},"exploitRefs":["https://github.com/win3zz/CVE-2026-1731"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-02-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1731","provenance":"source"},{"date":"2026-02-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2026-02-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb","provenance":"source"},{"date":"2026-02-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/cve-2026-1731/","provenance":"source"},{"date":"2026-02-13","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-02-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5559","provenance":"source"},{"date":"2026-03-04","kind":"report","label":"Named in ctrlaltintel.com: MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","url":"https://ctrlaltintel.com/research/MuddyWater/","provenance":"machine"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":7},"priority":{"score":91.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 264 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 5 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}