BeyondTrust Remote Support and Privileged Remote Access flaw CVE-2026-1731 exploited, including by ransomware gangs
Critical BeyondTrust Remote Support and Privileged Remote Access flaw (CVE-2026-1731) lets anyone run commands without logging in. Attacks include ransomware gangs. Cloud customers were patched on 2 Feb; self-hosted IT teams should apply the patch (RS 25.3.2, PRA 25.1.1) now.
If you run self-hosted BeyondTrust Remote Support or Privileged Remote Access, install the BT26-02 patch or upgrade to RS 25.3.2 or PRA 25.1.1 or later, and check for signs of compromise. Cloud-hosted customers and households need do nothing.
What’s happening
CVE-2026-1731 is a command-injection flaw in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), remote-support tools used by IT teams and service providers. An attacker on the internet can run commands on the server without logging in. BeyondTrust patched its cloud-hosted customers on 2 February 2026 and disclosed the flaw on 6 February, releasing fixes for self-hosted systems: Remote Support 25.3.2 and Privileged Remote Access 25.1.1. Public exploit code appeared on about 12 February, and attacks in the wild were reported on 13 February, the day CISA added the flaw to its list of exploited vulnerabilities. On 20 February CISA marked it as used in ransomware campaigns. Palo Alto Networks' Unit 42 reported data theft from organisations in finance, healthcare, education, technology, legal and retail. Reports differ on when exploitation began: one says BeyondTrust detected it on 31 January, another cites 10 February. We found no newer development in our search, and could not read BeyondTrust's own advisory page, so details come from press reports.
- What
- Flaw
- Affects
- BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), self-hosted
- Affected
- Remote Support (RS) 25.3.1 and earlier
Privileged Remote Access (PRA) 24.3.4 and earlier - Fixed in
- Remote Support 25.3.2
Privileged Remote Access 25.1.1 or later
Cloud-hosted instances patched 2 February 2026 - Since
- 6 Feb 2026
- Closed
- 20 Feb 2026
Timeline
- Wider attacks
CISA marked the flaw as known to be used in ransomware campaigns. Palo Alto Networks' Unit 42 reported data theft from victims in several industries across North America, France, Germany and Australia.
- CISA added
CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalogue and gave US federal agencies three days to patch or stop using the product.
- Wider attacks
Public exploit code appeared after researchers analysed the patch, and attacks in the wild were reported the following day.
- Made publicFixed
BeyondTrust publicly disclosed CVE-2026-1731, an unauthenticated command-injection flaw in Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier, and released patches for self-hosted customers (RS 25.3.2, PRA 25.1.1).
- New fixPartly fixed
BeyondTrust patched its cloud-hosted (SaaS) Remote Support and Privileged Remote Access instances automatically, so cloud customers needed to do nothing.
Sources
- BeyondTrust security advisory BT26-02 (page could not be read; listed by CISA)BeyondTrust · 6 Feb 2026
- CISA: BeyondTrust RCE flaw now exploited in ransomware attacksBleepingComputer · 20 Feb 2026
- BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731)Help Net Security · 20 Feb 2026