Vulnerability Number: CVE-2026-1731
Severity Level: Critical 9.9
Executive Summary
BeyondTrust has disclosed a pre‑authentication remote code execution flaw in its Remote Support and older Privileged Remote Access products. The vulnerability is triggered by a crafted WebSocket ”remoteVersion” parameter that allows unauthenticated attackers to execute arbitrary operating‑system commands with high privileges. Active exploitation has been observed in the wild, including deployment of web shells, ransomware‑like tools, and data exfiltration
Details
The flaw resides in the thin‑scc‑wrapper component, which parses the remoteVersion value using Bash arithmetic contexts. Insufficient sanitization permits command substitution (e.g., $(cmd)) to be evaluated before the version check, resulting in OS command injection (CWE‑78).
BeyondTrust released advisory BT26‑02 on 6 Feb 2026 and issued patches for affected versions. Dataprise Labs discovery has confirmed active exploitation: threat actors performed network reconnaissance, created domain and local accounts, deployed multiple web shells (single‑line PHP backdoor, aws.php, password‑protected file_save.php), used the Go‑based SparkRAT and VShell Linux backdoors, leveraged Bash droppers that hide in‑memory PHP payloads, and exfiltrated hostnames via DNS tunnelling to OAST services. Palo Alto Networks’ Cortex Xpanse has reportedly identified more than 10 600 publicly exposed BeyondTrust instances as of the publication date.
Impact
Successful exploitation can lead to unauthenticated remote code execution, full system compromise, creation of privileged accounts, deployment of persistent backdoors (SparkRAT, VShell), lateral movement across internal networks, and exfiltration of sensitive data or configuration files. The activity has been observed in multiple sectors—including financial services, legal, high‑technology, higher education, wholesale/retail, and healthcare—across the United States, France, Germany, Australia, and Canada.
Mitigation Strategies
1. Apply the official BeyondTrust patches:
- Remote Support – BT26‑02‑RS (covers v21.3 – 25.3.1) or upgrade to Remote Support 25.3.2 or newer.
- Privileged Remote Access – BT26‑02‑PRA (covers v22.1 – 24.x) or upgrade to PRA 25.1 or newer.
2. Enable the automatic update service on all self‑hosted appliances to receive future fixes without manual intervention.
3. Restrict access to the Remote Support WebSocket endpoint to internal, segmented management networks and enforce zero‑trust controls.
4. Deploy detection and response tooling, use Advanced URL Filtering and Advanced DNS Security to block known malicious C2 domains.
5. Conduct forensic review for signs of compromise (unexpected accounts, web‑shell files, abnormal network traffic) and engage the Dataprise Incident Response team or BeyondTrust Support if a breach is suspected.
Sources
- CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1731
- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-1731
- BeyondTrust Security Advisory BT26‑02: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
Contributing Authors
Dallas Myers – Dataprise Cyber Security Services
