{"id":"beyondtrust-rs-pra-command-injection-feb-2026","category":"patch","status":"closed","title":"BeyondTrust Remote Support and Privileged Remote Access flaw CVE-2026-1731 exploited, including by ransomware gangs","tldr":"Critical BeyondTrust Remote Support and Privileged Remote Access flaw (CVE-2026-1731) lets anyone run commands without logging in. Attacks include ransomware gangs. Cloud customers were patched on 2 Feb; self-hosted IT teams should apply the patch (RS 25.3.2, PRA 25.1.1) now.","summary":"CVE-2026-1731 is a command-injection flaw in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), remote-support tools used by IT teams and service providers. An attacker on the internet can run commands on the server without logging in. BeyondTrust patched its cloud-hosted customers on 2 February 2026 and disclosed the flaw on 6 February, releasing fixes for self-hosted systems: Remote Support 25.3.2 and Privileged Remote Access 25.1.1. Public exploit code appeared on about 12 February, and attacks in the wild were reported on 13 February, the day CISA added the flaw to its list of exploited vulnerabilities. On 20 February CISA marked it as used in ransomware campaigns. Palo Alto Networks' Unit 42 reported data theft from organisations in finance, healthcare, education, technology, legal and retail. Reports differ on when exploitation began: one says BeyondTrust detected it on 31 January, another cites 10 February. We found no newer development in our search, and could not read BeyondTrust's own advisory page, so details come from press reports.","action":"If you run self-hosted BeyondTrust Remote Support or Privileged Remote Access, install the BT26-02 patch or upgrade to RS 25.3.2 or PRA 25.1.1 or later, and check for signs of compromise. Cloud-hosted customers and households need do nothing.","product":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), self-hosted","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-1731"],"tags":["beyondtrust","remote-support","privileged-remote-access","command-injection","ransomware","cisa-kev","zero-day"],"affected":["Remote Support (RS) 25.3.1 and earlier","Privileged Remote Access (PRA) 24.3.4 and earlier"],"fixed":["Remote Support 25.3.2","Privileged Remote Access 25.1.1 or later","Cloud-hosted instances patched 2 February 2026"],"matches":[],"sources":[{"kind":"advisory","title":"BeyondTrust security advisory BT26-02 (page could not be read; listed by CISA)","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-02","by":"BeyondTrust","date":"2026-02-06"},{"kind":"news","title":"CISA: BeyondTrust RCE flaw now exploited in ransomware attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-beyondtrust-rce-flaw-now-exploited-in-ransomware-attacks/","by":"BleepingComputer","date":"2026-02-20"},{"kind":"news","title":"BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731)","url":"https://www.helpnetsecurity.com/?p=356412","by":"Help Net Security","date":"2026-02-20"}],"started":"2026-02-06","closed":"2026-02-20","created":"2026-11-03T22:03:30.369Z","updated":"2026-11-03T22:03:30.369Z","cve_notes":[{"cve":"CVE-2026-1731","name":"Pre-login command injection in BeyondTrust RS and PRA","what":"An OS command injection in BeyondTrust Remote Support and Privileged Remote Access that lets an unauthenticated attacker send crafted requests and run commands on the server as the site user.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-02-20","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"CISA marked the flaw as known to be used in ransomware campaigns. Palo Alto Networks' Unit 42 reported data theft from victims in several industries across North America, France, Germany and Australia.","url":"https://www.helpnetsecurity.com/?p=356412","by":"Help Net Security","patch":null},{"at":"2026-02-13","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalogue and gave US federal agencies three days to patch or stop using the product.","url":"https://www.bleepingcomputer.com/news/security/cisa-beyondtrust-rce-flaw-now-exploited-in-ransomware-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-02-12","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Public exploit code appeared after researchers analysed the patch, and attacks in the wild were reported the following day.","url":"https://www.helpnetsecurity.com/?p=356412","by":"Help Net Security","patch":null},{"at":"2026-02-06","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"BeyondTrust publicly disclosed CVE-2026-1731, an unauthenticated command-injection flaw in Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier, and released patches for self-hosted customers (RS 25.3.2, PRA 25.1.1).","url":"https://www.bleepingcomputer.com/news/security/cisa-beyondtrust-rce-flaw-now-exploited-in-ransomware-attacks/","by":"BleepingComputer","patch":"patched"},{"at":"2026-02-02","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"BeyondTrust patched its cloud-hosted (SaaS) Remote Support and Privileged Remote Access instances automatically, so cloud customers needed to do nothing.","url":"https://www.helpnetsecurity.com/?p=356412","by":"Help Net Security","patch":"partial"}],"url":"https://hard.fyi/live/beyondtrust-rs-pra-command-injection-feb-2026/","json":"https://hard.fyi/api/live?id=beyondtrust-rs-pra-command-injection-feb-2026"}