CVE-2026-1731

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support versions 25.3.1 and earlier BeyondTrust Privileged Remote Access versions 24.3.4 and earlier

Description BeyondTrust Remote Support and Privileged Remote Access contain a pre-authentication operating system command injection flaw. This issue occurs because the software fails to neutralize special elements used in OS commands, allowing an unauthenticated remote attacker to execute arbitrary code in the context of the site user by sending specially crafted requests. Attackers have been observed extracting portal data and opening WebSocket channels to trigger this remote code execution. Approximately 11,000 instances of these products are exposed to the internet, with around 8,500 being on-premises deployments.

Recommendations For BeyondTrust Remote Support versions 25.3.1 and earlier, upgrade to version 25.3.2 or apply the BT26-02-RS patch. For BeyondTrust Privileged Remote Access versions 24.3.4 and earlier, upgrade to version 25.1.1 or apply the BT26-02-PRA patch.