- Critical 9.9
- Known exploited (CISA KEV)
- Used in ransomware (CISA)
CVE-2026-1731
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
Scores
The facts
- Published
- 6 February 2026
- Last changed
- 17 June 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.9 out of 10 (version 4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R… - Weakness
- Affects
- beyondtrust privileged remote access
- beyondtrust remote support
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 13 February 2026. CISA lists it as used in ransomware campaigns.
- EPSS
- 92.5% chance of exploitation activity in the next 30 days (percentile 100).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.