CVE Explorer
CVE-2026-1731
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
Known exploited
CISA KEV
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Remote Support(RS) & Privileged Remote Access(PRA)","vendor":"BeyondTrust","versions":[{"lessThanOrEqual":"RS 25.3.1","status":"affected","version":"0","versionType":"custom"},{"lessThanOrEqual":"PRA 24.3.4","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:ef57090845d84a18bcf6d50e69d51e4683a2e70c4f5e2cc99c7c9b44d1cee6ae · sha256:3e659a4020c6c222… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.9,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact"…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:ef57090845d84a18bcf6d50e69d51e4683a2e70c4f5e2cc99c7c9b44d1cee6ae · sha256:3e659a4020c6c222… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:ef57090845d84a18bcf6d50e69d51e4683a2e70c4f5e2cc99c7c9b44d1cee6ae · sha256:3e659a4020c6c222… · /containers/cna/problemTypes/0/descriptions/0
Known exploitation assertions
2 source assertions{"cwes":["CWE-78"],"dateAdded":"2026-02-13","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Known","notes":"Please adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 ; https://nvd.nist.gov/vuln/detail/CVE-2026-1731","product":"Remote Support (RS) and Privileged Remote Access (PRA)","requiredAction":"Apply mitigations per vendor instructions, follow…
- cisa_kev_jsonknown_exploitedurn:baitaphish:normalized-source-record:v2:eea4f857d2e5f550574264fd089b914b6f062a2038ba2ede843bbb4567aa510e · sha256:635dff916c4092c0… · /vulnerabilities/142Open source location →
{"cwes":["CWE-78"],"dateAdded":"2026-02-13","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Known","notes":"Please adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 ; https://nvd.nist.gov/vuln/detail/CVE-2026-1731","product":"Remote Support (RS) and Privileged Remote Access (PRA)","requiredAction":"Apply mitigations per vendor instructions, follow…
- cisa_kev_jsonknown_exploitedurn:baitaphish:normalized-source-record:v2:506e2c940fb9dcc922120894f518789f3c97a7b7608fe01189c7ac08fce9440e · sha256:16acee8334e59e44… · /vulnerabilities/139Open source location →
Source references
5 source assertions{"url":"https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:ef57090845d84a18bcf6d50e69d51e4683a2e70c4f5e2cc99c7c9b44d1cee6ae · sha256:3e659a4020c6c222… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/win3zz/CVE-2026-1731"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:ef57090845d84a18bcf6d50e69d51e4683a2e70c4f5e2cc99c7c9b44d1cee6ae · sha256:3e659a4020c6c222… · /containers/adp/0/references/0
{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:ef57090845d84a18bcf6d50e69d51e4683a2e70c4f5e2cc99c7c9b44d1cee6ae · sha256:3e659a4020c6c222… · /containers/cna/references/1
{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:ef57090845d84a18bcf6d50e69d51e4683a2e70c4f5e2cc99c7c9b44d1cee6ae · sha256:3e659a4020c6c222… · /containers/adp/0/references/1
{"tags":["third-party-advisory"],"url":"https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:ef57090845d84a18bcf6d50e69d51e4683a2e70c4f5e2cc99c7c9b44d1cee6ae · sha256:3e659a4020c6c222… · /containers/adp/0/references/2
Attribution and limitations
- CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.