CVE-2026-1731 — BeyondTrust Pre-Auth RCE, CVSS 9.8, CISA KEV, Actively Exploited — Unauthenticated OS Command Injection in Remote Support & Privileged Remote Access, SimpleHelp RAT Post-Exploitation, Full Domain Control, Silk Typhoon Predecessor Chain
CVE-2026-1731 (TL-2026-0110) is a critical-severity software vulnerability, first published 2026-02-16. It carries a reported China nexus and is not formally attributed, references 4 CVEs (CVE-2026-1731, CVE-2024-12356, CVE-2024-12686), maps to 27 MITRE ATT&CK techniques (T1003.001, T1018, T1021.002), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-0110
- Threat ID
- TL-2026-0110
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-02-16
- Last reviewed
- 2026-02-16
- Attribution confidence
- NONE
- Nation-state nexus
- China
- Motivation
- ESPIONAGE|FINANCIAL
- Target sectors
- Government, Financial Services, Healthcare, Technology, Hospitality, Critical Infrastructure
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in CVE-2026-1731
Malware and tooling: SimpleHelp
Critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) via Bash arithmetic evaluation command injection in WebSocket-reachable thin-scc-wrapper script, actively exploited with public PoC, CISA KEV listed, variant of CVE-2024-12356 used by Silk Typhoon to breach U.S. Treasury
How CVE-2026-1731 works
CVE-2026-1731 is a critical pre-authentication OS command injection vulnerability (CVSS 4.0: 9.9, CWE-78) in BeyondTrust Remote Support (RS) versions ≤25.3.1 and Privileged Remote Access (PRA) versions ≤24.3.4. The vulnerability exists in the thin-scc-wrapper Bash script, which processes attacker-controlled input (the remoteVersion value) from WebSocket connections to the /nw endpoint. Bash arithmetic evaluation in the [[ $localVersion -lt $remoteVersion ]] comparison treats operands as expressions rather than plain strings, allowing payloads like a[$(cmd)]0 to achieve arbitrary command execution as the SYSTEM site user — without authentication or user interaction.
This is a direct variant of CVE-2024-12356, which was exploited as a zero-day by Chinese state-sponsored group Silk Typhoon (Storm-0558) to breach the U.S. Treasury Department in December 2024, accessing OFAC sanctions data and other sensitive government information. Both vulnerabilities target the exact same WebSocket endpoint (/nw) and the same thin-scc-wrapper script. While BeyondTrust added a numeric sanity check (regex validation for 1-2 digit numbers) in the CVE-2026-1731 patch, the check was insufficient — Bash still performs expression evaluation on the operands even after regex validation, leaving the endpoint exploitable through a different code path.
The vulnerability was discovered on January 31, 2026 by Hacktron AI using AI-enabled variant analysis capabilities. Notably, the discovery came one day after watchTowr published analysis of CVE-2026-1281 in Ivanti EPMM, which exploits the identical Bash arithmetic evaluation primitive — suggesting cross-pollination between vulnerability research streams. BeyondTrust responded rapidly: cloud/SaaS instances were auto-patched by February 2, 2026 (2-day turnaround). Self-hosted customers must manually apply patches BT26-02-RS or BT26-02-PRA.
The patch itself was reverse-engineered by Rapid7, who demonstrated that BT26-02-RS.nss is encrypted with a static key ('Bingb0ng, what she said; the Tw1st3d switch is RED') using AES-256-CBC — meaning any attacker who knows this key can extract and diff the patch to construct an exploit. A public proof-of-concept was published on GitHub (win3zz/CVE-2026-1731) on February 10, 2026. Within 24 hours, GreyNoise observed active reconnaissance scanning for vulnerable instances.
Arctic Wolf has confirmed active exploitation campaigns against self-hosted BeyondTrust Remote Support deployments. Observed TTPs include: SimpleHelp RMM tool deployment for persistence (renamed binaries saved to C:\ProgramData and executed as SYSTEM via Bomgar processes), domain admin account creation via 'net user' and 'net group' commands, Active Directory enumeration via AdsiSearcher, PsExec lateral movement across domain, and Impacket SMBv2 session setup requests. This post-exploitation playbook closely mirrors enterprise ransomware precursor activity.
GreyNoise analysis reveals sophisticated reconnaissance: a single IP accounts for 86% of scanning sessions, operating through a Frankfurt-based commercial VPN service (MSS 1358 confirming VPN tunnel encapsulation). Scanners deliberately target non-standard ports (not just 443), knowing enterprises move BeyondTrust to non-default ports. JA4+ fingerprinting identifies two distinct exploit tools — a 5-header variant used by the top 5 IPs (all classified malicious) and a 7-header variant used by 10 single-session scanners. These same IPs simultaneously exploit SonicWall, MOVEit Transfer, Log4j, Sophos firewalls, and perform SSH brute-forcing — indicating multi-exploit threat actors.
Hacktron AI identified approximately 8,500 self-hosted BeyondTrust instances exposed to the internet (out of ~11,000 total including cloud). BeyondTrust serves 20,000+ customers across 100+ countries, including 75% of the Fortune 100, with heavy deployment in healthcare, financial services, government, and hospitality. The combination of trivial exploitation (single WebSocket message), SYSTEM-level access, and the product's role managing privileged access makes this one of the highest-impact vulnerabilities of 2026.
MITRE ATT&CK techniques used in TL-2026-0110
credential-access
T1003.001 LSASS Memory; T1555 Credentials from Password Stores
discovery
T1018 Remote System Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1135 Network Share Discovery
lateral-movement
T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer
defense-evasion
T1036.003 Rename Legitimate Utilities; T1078.002 Domain Accounts
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059.003 Windows Command Shell; T1059.004 Unix Shell
command-and-control
T1071.001 Web Protocols; T1219 Remote Access Tools
persistence
T1098 Account Manipulation; T1098.003 Additional Cloud Roles; T1136.001 Local Account; T1136.002 Domain Account
initial-access
T1190 Exploit Public-Facing Application
collection
T1213 Data from Information Repositories; T1213.003 Code Repositories
impact
resource-development
reconnaissance
T1595.002 Vulnerability Scanning
defense-impairment
Remediation for CVE-2026-1731
Patches
- BT26-02-RS: Patch for Remote Support v21.3–25.3.1 (fixed in RS v25.3.2+)
- BT26-02-PRA: Patch for Privileged Remote Access v22.1–24.3.4 (fixed in PRA v25.1.1+)
Immediate actions
- Apply patch BT26-02-RS for Remote Support versions 21.3–25.3.1 immediately
- Apply patch BT26-02-PRA for Privileged Remote Access versions 22.1–24.3.4 immediately
- Cloud/SaaS customers are auto-patched as of February 2, 2026 — no action needed
- Self-hosted RS versions older than 21.3 and PRA versions older than 22.1 MUST upgrade to a supported version before patching
- CISA BOD 22-01 remediation deadline: February 16, 2026 (TODAY)
- Block WebSocket connections to /nw endpoint from untrusted networks as emergency mitigation if patching is delayed
Workarounds
- Block external WebSocket connections to the /nw endpoint via WAF or reverse proxy rules
- Restrict access to BeyondTrust appliance ports (443 and any non-standard ports) to trusted IP ranges only
- Monitor for exploitation IOCs: SimpleHelp binaries in C:\ProgramData, net user/net group domain admin commands, AdsiSearcher AD enumeration
Longer-term hardening
- Enable automatic updates for BeyondTrust deployments where possible
- Restrict BeyondTrust appliance access to known admin IP ranges via firewall/ACL — do not expose directly to the internet
- Monitor for SimpleHelp RMM tool deployment, unauthorized domain admin account creation, and PsExec lateral movement as post-exploitation indicators
- Implement network segmentation between BeyondTrust appliances and sensitive internal networks
- Review BeyondTrust session logs for unauthorized access during the exposure window (February 6–present for unpatched instances)
- Consider migration from self-hosted to cloud/SaaS deployment to benefit from automatic patching
CVEs associated with CVE-2026-1731
CVE-2026-1731, CVE-2024-12356, CVE-2024-12686, CVE-2025-1094
Weaknesses (CWE) in CVE-2026-1731
CWE-78
Timeline of CVE-2026-1731
- Silk Typhoon (Storm-0558) exploits CVE-2024-12356 zero-day in BeyondTrust RS to breach U.S. Treasury Department, accessing OFAC sanctions data. Same WebSocket /nw endpoint. Source: https://www.rapid7.com/blog/post/etr-cve-2026-1731-critical-unauthenticated-remote-code-execution-rce-beyondtrust-remote-support-rs-privileged-remote-access-pra/
- GreyNoise observes a Polish hosting IP replaying the exact Treasury breach exploit chain (CVE-2024-12356 + CVE-2025-1094 SQLi) against BeyondTrust instances via /nw WebSocket path. Old exploit chain still in active use. Source: https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731
- watchTowr publishes Bash arithmetic evaluation exploitation in Ivanti EPMM (CVE-2026-1281/CVE-2026-1340) — identical root cause class to CVE-2026-1731. Source: https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/
- Hacktron AI discovers CVE-2026-1731 via AI-enabled variant analysis of CVE-2024-12356. Reports to BeyondTrust same day. Discovery came one day after watchTowr's Bash arithmetic evaluation research. Source: https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce
- BeyondTrust auto-patches all cloud/SaaS Remote Support and Privileged Remote Access instances. 2-day turnaround from disclosure to cloud remediation. Source: https://arcticwolf.com/resources/blog/cve-2026-1731/
- BeyondTrust publishes security advisory BT26-02 and releases patches BT26-02-RS and BT26-02-PRA for self-hosted customers. Hacktron AI, Rapid7, and Arctic Wolf publish coordinated advisories. Source: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
- Public proof-of-concept exploit published on GitHub (win3zz/CVE-2026-1731). Rapid7 publishes detailed AttackerKB analysis including patch decryption (static AES key), root cause (Bash arithmetic evaluation), and working reverse shell payload. Source: https://github.com/win3zz/CVE-2026-1731
- GreyNoise detects active reconnaissance scanning for CVE-2026-1731 within 24 hours of PoC release. Single IP accounts for 86% of sessions via Frankfurt VPN. Scanners target non-standard ports, use custom exploit tools (5-header and 7-header variants). Source: https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731
- CISA adds CVE-2026-1731 to Known Exploited Vulnerabilities catalog. Remediation deadline: February 16, 2026 (3-day deadline — extreme urgency). Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Arctic Wolf publishes updated bulletin confirming suspected exploitation of CVE-2026-1731 in the wild. Observed: SimpleHelp RMM deployment as SYSTEM, domain admin creation via net user/net group, AdsiSearcher AD enumeration, PsExec + Impacket lateral movement. Source: https://arcticwolf.com/resources/blog/update-arctic-wolf-observes-threat-campaign-targeting-beyondtrust-remote-support-following-cve-2026-1731-poc-availability/
- CISA BOD 22-01 remediation deadline for CVE-2026-1731. All federal agencies must have applied patches or mitigations by today. 3-day deadline reflects extreme severity assessment.
- As of 2026-05-29, CVE-2026-1731 (BeyondTrust RS/PRA pre-auth RCE, CVSS 9.9) is patched at the vendor but still actively exploited: it carries CISA KEV's ransomware flag and Unit 42 tracked ongoing VShell/SparkRAT compromises through May 19, 2026. With ~8,500 self-hosted instances still exposed and no takedown or successor, the threat remains ACTIVE, not merely PATCHED.
Sources cited for CVE-2026-1731
Threats related to CVE-2026-1731
Detection coverage for TL-2026-0110
As of 2026-02-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0110 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.