CVE-2026-1731

Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Affected

BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA)

CVSS v4.0 CNA

9.9 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

92.46% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-02-13, used in ransomware campaigns

Nuclei

critical · CWE-78

Published

2026-02-06

Updated

2026-02-26

Proof-of-concept exploits (3)

• win3zz/CVE-2026-173137★ · 2026-02-11
• jakubie07/CVE-2026-17316★ · 2026-05-02
• hexissam/CVE-2026-17311★ · 2026-02-22

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-1731.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_co…

Security advisories

• https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
• https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731

References

• CVE Record
• NVD entry

Related

• CVE-2017-5638
• CVE-2023-25157
• CVE-2023-43261
• CVE-2025-5777