Comprehensive Threat Exposure Management Platform
Hive Pro recognized in Gartner® Magic Quadrant™ for Exposure Assessment Platform, 2025 Watch platform in action
CVE-2026-1731 represents a critical unauthenticated remote code execution vulnerability affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) appliances, caused by an OS command injection flaw (CWE-78) in a WebSocket-accessible endpoint. With a CVSSv4 score of 9.9, this vulnerability enables attackers to execute arbitrary system commands without authentication or user interaction by sending specially crafted requests to vulnerable WebSocket endpoints, resulting in full system compromise, unauthorized access, data exfiltration, and lateral movement capabilities within enterprise environments. The vulnerability is actively exploited in the wild following public disclosure and availability of proof-of-concept exploit code.
The vulnerability impacts Remote Support versions 25.3.1 and earlier, and Privileged Remote Access versions 24.3.4 and earlier in self-hosted deployments. CVE-2026-1731 shares similarities with CVE-2024-12356, a previously exploited zero-day affecting related WebSocket functionality in BeyondTrust appliances, suggesting attackers are systematically targeting WebSocket attack surfaces in these products. Because BeyondTrust Remote Support and Privileged Remote Access provide remote administration and privileged access management capabilities for sensitive infrastructure, successful exploitation grants attackers high-value control over critical enterprise systems including servers, workstations, network devices, and security appliances managed through these platforms.
Exploitation Timeline:
Security researchers estimate that thousands of on-premises BeyondTrust instances were internet-facing and potentially exposed at the time of public disclosure. Following PoC availability, widespread scanning and exploitation attempts were observed targeting both standard ports (443) and non-standard ports, indicating attackers anticipated defensive reconfiguration efforts. Threat actors successfully exploited vulnerable endpoints to execute system commands, and in documented cases deployed remote monitoring and management (RMM) tools to establish persistence for ongoing access.
Post-exploitation behaviors observed by security researchers include deployment of unauthorized RMM tools, unexpected PSExec execution across multiple hosts suggesting lateral movement attempts, and Impacket-based SMBv2 session activity indicative of credential harvesting and privilege escalation operations. The low attack complexity, requirement for no authentication or user interaction, and availability of public exploit code combined with confirmed active exploitation make CVE-2026-1731 an immediate priority for organizations running affected BeyondTrust deployments.
Root Cause: OS command injection (CWE-78) in WebSocket endpoint allows arbitrary system command execution without authentication
CVSSv4 Score: 9.9 (Critical) reflecting full system compromise risk
Affected Versions:
Similar Vulnerability: CVE-2024-12356 (previously exploited zero-day in BeyondTrust WebSocket functionality)
Active Exploitation Confirmed: Widespread scanning post-PoC release; RMM tool deployment for persistence; PSExec and Impacket-based lateral movement observed
High-Value Target: BeyondTrust products manage privileged access to sensitive infrastructure, making compromise extremely valuable to attackers
Initial Access: T1190 | Execution: T1059 | Reconnaissance: T1595.002 | Discovery: T1018 | Lateral Movement: T1021 | Command & Control: T1219 | Resource Development: T1588.006 | Privilege Escalation: T1068
Get through updates and upcoming events, and more directly in your inbox