CVSS 4.0
9.9 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:LCVE-2026-1731
Critical (9.9) in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). In CISA KEV since 2026-02-13, with known ransomware use. EPSS 93% chance of exploitation in the next 30 days.
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 93% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2026-02-13, due 2026-02-16, known ransomware use
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- beyondtrust:privileged_remote_access
- beyondtrust:remote_support
References
- https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293
- https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
- https://github.com/win3zz/CVE-2026-1731
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731
- https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731