CVE-2026-1731

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

CVSS v4.0

9.9 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

89.40% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-02-13, used in ransomware campaigns

Nuclei

critical · CWE-78

Published

2026-02-06

Updated

2026-02-26

Proof-of-concept exploits (3)

• win3zz/CVE-2026-173136★ · 2026-02-11
• jakubie07/CVE-2026-17316★ · 2026-05-02
• hexissam/CVE-2026-17310★ · 2026-02-22

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-1731.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_co…

References

• CVE Record
• NVD entry

Related

• CVE-2017-5638
• CVE-2023-25157
• CVE-2023-43261
• CVE-2025-5777
• CVE-2026-1729
• CVE-2026-1732