CVE-2026-1731 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection

Exploited in the wild Critical 9.9 Published 6 Feb 2026 Updated 26 Feb 2026

Unauthenticated attackers can execute OS commands via crafted requests in BeyondTrust Remote Support and Privileged Remote Access.

Exploited in the wild: Since 13 Feb 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-1731?

CVE-2026-1731 is a critical command injection vulnerability in BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA), published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Weakness: CWE-78

Which versions are affected by CVE-2026-1731?

It affects 2 products.

Products include Beyondtrust Privileged Remote Access, Beyondtrust Remote Support.

How do I fix CVE-2026-1731?

No fix has been published for CVE-2026-1731 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 16 Feb 2026.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-1731 being exploited?

Yes. Attackers have exploited CVE-2026-1731 in the wild since at least 13 Feb 2026, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 5 proofs of concept on GitHub.

Sources

Also known as GHSA-p5wr-5p37-2wm6.