CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-02-13Vulnerability

CVE-2026-1731

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.

Properties

Euvd product
Remote Support(RS) & Privileged Remote Access(PRA)
Vulnerability name
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
First seen
2026-02-26T15:04:15+00:00
Cvss score
9.8
Epss score
0.92463
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-02-16
Euvd assigner
BT
Retrieved at
2026-10-21T01:24:49+00:00
Exploited euvd since
2026-02-13T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2026-02-13
Score
9.8
Euvd base score version
4.0
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
BeyondTrust
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
9.9

Related Entities (22)

MENTIONED_IN (16)

→[Campaign]Tracking TamperedChef Clusters via Certificate and Code Reuse
→[Campaign]CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
→[Campaign]Threat Overview: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Being Exploited in Production Environments (Updated September 30)
→[Campaign]Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
→[Campaign]Uptick in Bomgar RMM Exploitation
→[Campaign]A Deep Dive Into Attempted Exploitation of CVE-2023-33538
→[Campaign]Unnamed campaign (ID 69a9…)
→[Campaign]Unnamed campaign (ID 69d4…)
→[Campaign]Unnamed campaign (ID 69d4…)
→[Campaign]Storm-1175 focuses gaze on vulnerable web-facing assets in high ...
→[Campaign]Unit42: Understanding Current Threats to Kubernetes Environments
→[Campaign]Unnamed campaign (ID 69b9…)
→[Campaign]Unnamed campaign (ID 6997…)
→[Campaign]Boggy Serpens Threat Assessment
→[Campaign]MuddyWater Exposed: Inside an Iranian APT operation
→[Campaign]VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

AFFECTS_PRODUCT (2)

→[Product]cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*

INVOLVES (2)

←[EmergentSignal]velocity_anomaly
←[Signal]kev_added · 2026-02-13

DESCRIBES (1)

←[KEVEntry]BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-1731 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal