Alerts

BeyondTrust Patches Critical Unauthenticated RCE in Remote Support and Privileged Remote Access (CVE-2026-1731)

Zero Day Wire

09 Feb 2026 — 2 min read

BeyondTrust has issued patches for a critical pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) products — the same software previously exploited as zero-days in the 2024 breach of the U.S. Treasury Department.

Tracked as CVE-2026-1731, the flaw is an OS command injection weakness that allows unauthenticated attackers to execute operating system commands through maliciously crafted client requests. No authentication, privileges, or user interaction are required for exploitation.

"Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption," BeyondTrust stated in its advisory.

Affected Versions and Patching

The vulnerability affects Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier.

BeyondTrust secured all cloud RS/PRA instances by February 2. On-premises customers must manually upgrade to Remote Support 25.3.2 or Privileged Remote Access 25.1.1 or later if automatic updates are not enabled.

8,500 On-Premises Instances Potentially Exposed

Security researchers from Hacktron AI, who discovered the vulnerability, warned that approximately 11,000 RS/PRA instances are internet-exposed, including both cloud and on-premises deployments. Roughly 8,500 of those are on-premises systems that remain potentially vulnerable if patches have not been applied.

BeyondTrust confirmed there is no known active exploitation of CVE-2026-1731 at this time.

History of Zero-Day Exploitation

BeyondTrust's remote access products have a documented history of being targeted by advanced threat actors. In late 2024, attackers used a stolen API key to compromise 17 Remote Support SaaS instances after exploiting two RS/PRA zero-days — CVE-2024-12356 and CVE-2024-12686.

That campaign was subsequently linked to Silk Typhoon, a Chinese state-backed espionage group that leveraged the compromised BeyondTrust instance to breach the U.S. Treasury Department, accessing unclassified information related to sanctions actions. The same group also targeted the Committee on Foreign Investment in the United States (CFIUS) and the Office of Foreign Assets Control (OFAC).

Given this history, organizations running on-premises RS/PRA deployments should treat this patch with high urgency despite the absence of confirmed exploitation.

Recommendation

Upgrade immediately to Remote Support 25.3.2+ or Privileged Remote Access 25.1.1+. Verify that internet-facing RS/PRA instances are patched and restrict network access to management interfaces where possible. Organizations should also review BeyondTrust's June 2025 advisory for the related Server-Side Template Injection flaw to ensure that fix was also applied.

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected. The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS. The campaign, which ran from

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors