CVE-2026-1731: BEYONDTRUST ZERO-CLICK RCE FLAW

Overview

CVE-2026-1731 allows unauthenticated remote attackers to execute OS commands on BeyondTrust Remote Support and older Privileged Remote Access versions. This pre-authentication flaw bypasses security controls.

This vulnerability is actively exploited, granting full system control without authentication or user interaction. Immediate action is required.

CVSS Score: 9.8

Affected: BEYONDTRUST

Tags: RCE · ZERO-CLICK · CRITICAL · KEV

Timeline

• JAN 2026 — Vulnerability privately discovered
• FEB 2026 — CVE-2026-1731 publicly disclosed
• FEB 2026 — Active exploitation detected in the wild
• FEB 2026 — BeyondTrust releases security advisories & patches

Mitigation Steps

1. Apply Vendor Patches (CRITICAL) — Immediately update BeyondTrust Remote Support and Privileged Remote Access to the latest versions. Refer to BT26-02.
2. Network Segmentation (HIGH) — Isolate BeyondTrust appliances from public internet access where possible to limit exposure.
3. Monitor for IoCs (HIGH) — Actively scan logs and network traffic for indicators of compromise related to this RCE.
4. Review Access Controls (MEDIUM) — Audit and restrict network access to BeyondTrust appliances to authorized personnel only.

Published by Cyber121 Team. Stay ahead of threats at cyber121.com.