Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

BeyondTrust Remote Support and Privileged Remote Access pre-auth OS command injection (CVE-2026-1731)

Vulnerability
First reported
Last updated
Happening score
H score 61
2 unique sources, 5 articles

Summary

Hide ▲

CVE-2026-1731 is a critical pre-authentication OS command injection in BeyondTrust Remote Support and Privileged Remote Access that can let an unauthenticated attacker execute commands remotely in the site-user context. BeyondTrust patched Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier, with fixes in BT26-02-RS / 25.3.2+ and BT26-02-PRA / 25.1.1+. Research published on 2026-02-13 says watchTowr observed first in-the-wild exploitation across its global sensors, with attackers abusing get_portal_info to extract x-ns-company before establishing a WebSocket channel. Successful exploitation can lead to unauthorized access, data exfiltration, and service disruption.

Cases

BeyondTrust CVE-2026-1731 exploitation and remediation (3)

Related Happenings

Verizon 2026 DBIR shows vulnerability exploitation as the top breach access trend in 2025

Target Trend
First: 20.05.2026 03:04 Last: 20.05.2026 03:04 Sources 1

About this happening: **Vulnerability exploitation** became the leading breach access vector in **2025**, increasing compromise risk across **31,000 incidents** and **22,000+ confirmed breaches**. **Un...

Open Happening

OpenAI launches Daybreak cybersecurity initiative for AI-powered vulnerability detection and patch validation

Security Tool/Service
First: 12.05.2026 09:55 Last: 12.05.2026 09:55 Sources 1

About this happening: OpenAI's **Daybreak** launch adds an **AI-powered cybersecurity service** for **vulnerability detection** and **patch validation**, helping organizations fix flaws before attacker...

Open Happening

CPanel & WHM authentication-bypass exploitation wave (CVE-2026-41940)

Exploitation Wave
First: 04.05.2026 11:25 Last: 04.05.2026 11:25 Sources 1

About this happening: Active exploitation of **CVE-2026-41940** is driving a **large cPanel & WHM compromise wave**, putting exposed servers at risk of administrative takeover. **More than 40,000 serve...

Open Happening

Federal civilian executive branch agency hit by network compromise

Incident
First: 24.04.2026 23:34 Last: 24.04.2026 23:34 Sources 1

About this happening: A **federal civilian executive branch agency** was compromised in an **early September 2025** intrusion that left attackers with persistent access on **Cisco Firepower** and **Sec...

Open Happening

Grafana prompt injection exfiltration security flaw

Vulnerability
First: 07.04.2026 17:00 Last: 07.04.2026 17:00 Sources 1

About this happening: **GrafanaGhost** is a critical **Grafana** vulnerability that attackers are using to silently exfiltrate sensitive enterprise data from monitoring environments. The flaw bypasses...

Open Happening

Timeline

  1. 09.02.2026 15:07 1 articles · 3mo ago

    BeyondTrust secures RS/PRA cloud systems

    Mitigation Patch Update

    BeyondTrust secured all RS/PRA cloud systems by February 2, 2026 and directed on-premises customers to manually upgrade to Remote Support 25.3.2 or later and Privileged Remote Access 25.1.1 or later if automatic updates were not enabled.

    Show sources
    Open in new tab
  2. 09.02.2026 10:03 4 articles · 3mo ago

    Harsh Jaiswal discovers CVE-2026-1731

    Technical Analysis Update

    Security researcher and Hacktron AI co-founder Harsh Jaiswal discovered CVE-2026-1731 in BeyondTrust Remote Support and older Privileged Remote Access through AI-enabled variant analysis, identifying a critical pre-authentication operating system command injection that could let an unauthenticated remote attacker execute operating system commands in the site-user context; he also estimated about 11,000 internet-exposed instances, including about 8,500 on-prem deployments, could remain vulnerable without patches.

    Show sources
    Open in new tab
  3. 09.02.2026 10:03 2 articles · 3mo ago

    BeyondTrust releases fixes for CVE-2026-1731

    Mitigation Patch Update

    BeyondTrust released advisory updates and patches for CVE-2026-1731 affecting Remote Support 25.3.1 and prior and Privileged Remote Access 24.3.4 and prior, with Remote Support fixed in BT26-02-RS, 25.3.2 and later, and Privileged Remote Access fixed in BT26-02-PRA, 25.1.1 and later; self-hosted customers were urged to manually apply the patch or upgrade older installations before remediation.

    Show sources
    Open in new tab
  4. 09.02.2026 10:03 2 articles · 3mo ago

    BeyondTrust releases fixes for CVE-2026-1731

    Mitigation Patch Update

    BeyondTrust released advisory updates and patches for CVE-2026-1731 affecting Remote Support 25.3.1 and prior and Privileged Remote Access 24.3.4 and prior, with Remote Support fixed in BT26-02-RS, 25.3.2 and later, and Privileged Remote Access fixed in BT26-02-PRA, 25.1.1 and later; self-hosted customers were urged to manually apply the patch or upgrade older installations before remediation.

    Show sources
    Open in new tab