Vulnerability · CVE-2026-1731

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

Published Feb 6, 2026 · corrected/updated Jun 17, 2026 · BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) · evidence confidence very high

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption. Initial-access exploit intelligence.

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-1731 is a critical public vulnerability record for BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). CISA lists it as known exploited. Published remediation guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: beyondtrust/privileged remote access; beyondtrust/remote support; BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). Published remediation guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 9.9, EPSS 92.5%. CISA lists it as known exploited. Weakness classes: CWE-78. Sources contributing to this record: cisa_kev, cve_org, epss, metasploit. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

Exploitation evidence
Confirmed in CISA KEV since Feb 9, 2026. Listed in CISA KEV and VulnCheck KEV.
Patch and remediation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA due date Feb 16, 2026.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Feb 6, 2026 · Catalog
Detected
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfi
Feb 13, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Feb 16, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfi

Affected

cpe beyondtrust/privileged remote accessversion unspecified
cpe beyondtrust/remote supportversion unspecified
vendor BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)version unspecified

Sources

CISA KEVConfirmed exploitationCVE-2026-1731
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfi
cisa.gov
CVE.orgVulnerability recordCVE-2026-1731
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-1731
30-day exploitation probability 92.5%
first.org
Metasploit ModulesPublic exploit moduleexploit_linux/http/beyondtrust_pra_rs_command_injection
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2026-1731
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating syste
nvd.nist.gov
VulnCheck KEVConfirmed exploitationCVE-2026-1731
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation re
vulncheck.com