/
← Voltar ao feed
critical healthcare financial services government hospitality enterprise

Pre-auth RCE CVE-2026-1731 (CVSS 9.9) in BeyondTrust Remote Support and older Privileged Remote Access

1 fonte(s) · 1 atualização(ões) · publicado 05/02/2026 21:00 · coletado há 1 dia

Hacktron AI disclosed CVE-2026-1731, a critical (CVSS 9.9) pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). An unauthenticated remote attacker could run operating system commands in the context of the site user. Hacktron found the flaw through AI-enabled variant analysis and reported it responsibly. It says exploitation is straightforward, but the article does not report in-the-wild exploitation. Hacktron's Shodan/Fofa analysis shows roughly 11,000 internet-exposed RS instances, about 8,500 of them on-prem and potentially unpatched. Commonly affected sectors include large enterprises, healthcare, financial services, government and hospitality.

Technical Details

  • Vulnerability class: pre-authentication OS command execution, in the context of the site user.
  • Hacktron is withholding technical details to give defenders time to patch.
  • Exposure estimate: ~11,000 internet-facing RS instances (cloud and on-prem), ~8,500 of them on-prem.
  • Reference: BeyondTrust Security Advisory BT26-02.

Remediation

  • Cloud/SaaS Remote Support customers: BeyondTrust patched all instances as of 2 February 2026.
  • Self-hosted RS and PRA customers not on automatic updates must apply the patch manually and immediately.
  • Review the BeyondTrust advisory BT26-02 for affected and fixed versions.

Linha do tempo

  1. hacktron.ai ↗ · pub. 05/02/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Pre-auth RCE CVE-2026-1731 (CVSS 9.9) in BeyondTrust Remote Support and older Privileged Remote Access

    ler a análise desta fonte

    Hacktron AI disclosed CVE-2026-1731, a critical (CVSS 9.9) pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). An unauthenticated remote attacker could run operating system commands in the context of the site user. Hacktron found the flaw through AI-enabled variant analysis and reported it responsibly. It says exploitation is straightforward, but the article does not report in-the-wild exploitation. Hacktron's Shodan/Fofa analysis shows roughly 11,000 internet-exposed RS instances, about 8,500 of them on-prem and potentially unpatched. Commonly affected sectors include large enterprises, healthcare, financial services, government and hospitality.

    Technical Details

    • Vulnerability class: pre-authentication OS command execution, in the context of the site user.
    • Hacktron is withholding technical details to give defenders time to patch.
    • Exposure estimate: ~11,000 internet-facing RS instances (cloud and on-prem), ~8,500 of them on-prem.
    • Reference: BeyondTrust Security Advisory BT26-02.

    Remediation

    • Cloud/SaaS Remote Support customers: BeyondTrust patched all instances as of 2 February 2026.
    • Self-hosted RS and PRA customers not on automatic updates must apply the patch manually and immediately.
    • Review the BeyondTrust advisory BT26-02 for affected and fixed versions.