Threats / BeyondTrust / CVE-2026-1731
CVE-2026-1731
· EUVD no mirror located
· GCVE no mirror located
Verified 2026-06-06
BeyondTrust Remote Support (RS) and Privileged Access (PRA) vulnerability
BeyondTrust Remote Support and Privileged Remote Access contain an unauthenticated OS command injection vulnerability allowing remote attackers to execute arbitrary system commands and compromise affected systems.
Verdict
Today item, not a backlog item.
An unauthenticated remote attacker can inject and execute operating system commands through a network request, potentially gaining full system access, exfiltrating data, and disrupting services without requiring credentials or user interaction.
01
Is it exploitable?
— the evidence, ranked above the scoreExploited in the wild
Listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-02-13), flagged for known ransomware use.
Probability (EPSS)
EPSS 0.80065 — modeled likelihood of exploitation activity.EPSS is a daily-changing model output — open the source for today's value.
Severity / affected
Affected: BeyondTrust, Remote Support (RS) and Privileged Remote Access (PRA). Confirm exact fixed builds in the vendor advisory.
Weakness (CWE)
Mapped to CWE-78 OS Command Injection — weakness family: Injection.CWE assignment from the public NVD record; the weakness class drives how the flaw is exploited.
02
Who’s exploiting it?
— attribution turns risk into urgencyAttribution not established
No threat-actor attribution is established from the public feed for this record. Absence of a named actor is not absence of compromise — see Coverage & confidence.
03
Why it matters
— the attack path, told twice: adversary, then board1
Front door — unauthenticated access narrative 1
Attacker
I craft a malicious request containing OS command injection payloads targeting the vulnerable endpoint in BeyondTrust RS or PRA.
Business
Attackers gain initial network access to systems running vulnerable BeyondTrust products without authentication barriers.
2
Keys to the kingdom — privilege/identity takeover narrative 2
Attacker
I execute arbitrary operating system commands in the context of the site user, escalating privileges and establishing persistence.
Business
Threat actors obtain elevated system access and maintain long-term presence within the infrastructure.
3
Lateral reach — past segmentation narrative 3
Attacker
I exfiltrate sensitive data, credentials, and configuration files from the compromised system and connected networks.
Business
Confidential information, authentication tokens, and intellectual property are stolen and exposed to adversaries.
4
Data at risk — exfiltration narrative 4
Attacker
I deploy ransomware or destructive payloads across the environment using the compromised system as a pivot point.
Business
Operations are disrupted, systems are encrypted or destroyed, and ransom demands are issued to the organization.
04
What to do
— defensible action- Remediate per the vendor advisory — confirm the fixed build for your version and verify exposure.1
Say it to the boardA vulnerability with this evidence profile is a defensible budget line, not a backlog ticket — fund the change against the proof above.
05
Coverage & confidence
— what we know, and what we don’tEstablished (cited)
Coverage gaps — stated, not hidden
Disclosure & credit2
Catalogued by BTCNA
Credited with finding itNo finder named in the public CVE record — the work behind this find is unattributed.