BeyondTrust CVE-2026-1731 exploitation and remediation

Attackers are exploiting **CVE-2026-1731** in **BeyondTrust Remote Support** and **Privileged Remote Access**, a critical pre-authentication OS command injection that lets an unauthenticated remote attacker execute operating system commands in the site-user context. The flaw affects **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**, and successful exploitation can lead to unauthorized access, data exfiltration, and service disruption. watchTowr reported first in-the-wild exploitation on 2026-02-13 and said attackers are abusing **/get_portal_info** to extract **x-ns-company** before opening a WebSocket channel. Hacktron estimated about **11,000** internet-exposed instances, including roughly **8,500** on-premises deployments, which leaves a large self-hosted exposure surface. BeyondTrust said its cloud systems were secured by February 2, 2026, but self-hosted customers still need to apply **BT26-02-RS** or **BT26-02-PRA**, or upgrade to **Remote Support 25.3.2+** and **Privileged Remote Access 25.1.1+**. CISA added **CVE-2026-1731** to the **KEV catalog** and directed federal agencies to apply the patch or stop using affected deployments within three days. Available evidence does not quantify compromise scope, but the active exploitation and KEV deadline make exposed appliances high priority for verification and patching. Internet-facing systems should be checked for signs of compromise and upgraded or removed from service if they cannot be remediated.