CVE-2026-1731

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA): OS Command Injection

As of , CVE-2026-1731 in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch now.

Exploited
Yes: CISA listed it on 13 February 2026
US federal deadline
16 February 20263 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
KnownCISA changed it from Unknown to Known on 19 February 2026.
EPSS score
0.91Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
Public exploit
1 Metasploit module
Fix
Vendor advice: www.beyondtrust.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA's required action

  • www.beyondtrust.comPlease adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet…

What the flaw is

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.

CISA's description

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

The CVE record's description, from BT

CVE published
6 February 2026
Assigned by
BT
CVSS
9.9 Critical (CVSS 4.0, from the CNA)
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Ransomware use: Unknown to Known.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Executionexploit module, rank excellent

Read further