CVE-2026-1731

What is CVE-2026-1731?

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Timeline

• 2026-02-06Published to the U.S. National Vulnerability Database (NVD)
• 2026-02-13Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
• 2026-02-16CISA federal remediation deadline (BOD 22-01)
• 2026-04-22First covered in a defend.network daily briefing
• 2026-06-17NVD record last updated

CISA Known Exploited Vulnerability

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

Affected product

BeyondTrust Remote Support (RS) And Privileged Remote Access (PRA)

NVD also lists CPE entries for: Beyondtrust Privileged Remote Access, Beyondtrust Remote Support

References

• https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
• https://github.com/win3zz/CVE-2026-1731
• https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731
• https://nvd.nist.gov/vuln/detail/CVE-2026-1731
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Referenced in our briefings & reports

• Docker & npm supply-chain hits; Lotus Wiper on Venezuelan energy (2026-04-23)
• Russian APT token theft; Gentlemen ransomware claims 1,570 victims (2026-04-22)

Related vulnerabilities

• CVE-2026-102764 – BeyondTrust Remote Support (same product)
• CVE-2026-106931 – EG Secure Solutions SiteGuard Server Edition (same weakness: CWE-78)
• CVE-2026-110447 – Collabora Online – Built-In CODE Server (same weakness: CWE-78)
• CVE-2026-83549 – SonicWall SMA1000 Appliances (same weakness: CWE-78)
• CVE-2026-73570 – Synacor Zimbra Collaboration Suite (ZCS) (same weakness: CWE-78)
• CVE-2026-48362 – Adobe Coldfusion (same weakness: CWE-78)