CVE-2026-1731 — BeyondTrust Pre-Auth RCE, CVSS 9.8, CISA KEV, Actively Exploited — Unauthenticated OS Command Injection in Remote Support & Privileged Remote Access, SimpleHelp RAT Post-Exploitation, Full Domain Control, Silk Typhoon Predecessor Chain — Threadlinqs Intelligence
As of 2026-05-30, CVE-2026-1731 — BeyondTrust Pre-Auth RCE, CVSS 9.8, CISA KEV, Actively Exploited — Unauthenticated OS Command Injection in Remote Support & Privileged Remote Access, SimpleHelp RAT Post-Exploitation, Full Domain Control, Silk Typhoon Predecessor Chain is a critical-severity vulnerability threat attributed to a China (predecessor exploitation)-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 33 indicators of compromise.
Threat ID: TL-2026-0110 · Severity: CRITICAL · Status: ACTIVE · Category: VULNERABILITY
Attribution: China (predecessor exploitation) · ESPIONAGE|FINANCIAL
Critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) via Bash arithmetic evaluation command injection in
CVE-2026-1731 is a critical pre-authentication OS command injection vulnerability (CVSS 4.0: 9.9, CWE-78) in BeyondTrust Remote Support (RS) versions ≤25.3.1 and Privileged Remote Access (PRA) versions ≤24.3.4. The vulnerability exists in the thin-scc-wrapper Bash script, which processes attacker-controlled input (the remoteVersion value) from WebSocket connections to the /nw endpoint. Bash arithmetic evaluation in the [[ $localVersion -lt $remoteVersion ]] comparison treats operands as expressions rather than plain strings, allowing payloads like a[$(cmd)]0 to achieve arbitrary command execution as the SYSTEM site user — without authentication or user interaction.
This is a direct variant of CVE-2024-12356, which was exploited as a zero-day by Chinese state-sponsored group Silk Typhoon (Storm-0558) to breach the U.S. Treasury Department in December 2024, accessing OFAC sanctions data and other sensitive government information. Both vulnerabilities target the exact same WebSocket endpoint (/nw) and the same thin-scc-wrapper script. While BeyondTrust added a numeric sanity check (regex validation for 1-2 digit numbers) in the CVE-2026-1731 patch, the check was insufficient — Bash still performs expression evaluation on the operands even after regex validation, leaving the endpoint exploitable through a different code path.
The vulnerability was discovered on January 31, 2026 by Hacktron AI using AI-enabled variant analysis capabilities. Notably, the discovery came one day after watchTowr published analysis of CVE-2026-1281 in Ivanti EPMM, which exploits the identical Bash arithmetic evaluation primitive — suggesting cross-pollination between vulnerability research streams. BeyondTrust responded rapidly: cloud/SaaS instances were auto-patched by February 2, 2026 (2-day turnaround). Self-hosted customers must manually apply patches BT26-02-RS or BT26-02-PRA.
The patch itself was reverse-engineered by Rapid7, who demonstrated that BT26-02-RS.nss is encrypted with a static key ('Bingb0ng, what she said; the Tw1st3d switch is RED') using AES-256-CBC — meaning any attacker who knows this key can extract and diff the patch to construct an exploit. A public proof-of-concept was published on GitHub (win3zz/CVE-2026-1731) on February 10, 2026. Within 24 hours, GreyNoise observed active reconnaissance scanning for vulnerable instances.
Arctic Wolf has confirmed active exploitation campaigns against self-hosted BeyondTrust Remote Support deployments. Observed TTPs include: SimpleHelp RMM tool deployment for persistence (renamed binaries saved to C:\ProgramData and executed as SYSTEM via Bomgar processes), domain admin account creation via 'net user' and 'net group' commands, Active Directory enumeration via AdsiSearcher, PsExec lateral movement across domain, and Impacket SMBv2 session setup requests. This post-exploitation playbook closely mirrors enterprise ransomware precursor activity.
GreyNoise analysis reveals sophisticated reconnaissance: a single IP accounts for 86% of scanning sessions, operating through a Frankfurt-based commercial VPN service (MSS 1358 confirming VPN tunnel encapsulation). Scanners deliberately target non-standard ports (not just 443), knowing enterprises move BeyondTrust to non-default ports. JA4+ fingerprinting identifies two distinct exploit tools — a 5-header variant used by the top 5 IPs (all classified malicious) and a 7-header variant used by 10 single-session scanners. These same IPs simultaneously exploit SonicWall, MOVEit Transfer, Log4j, Sophos firewalls, and perform SSH brute-forcing — indicating multi-exploit threat actors.
Hacktron AI identified approximately 8,500 self-hosted BeyondTrust instances exposed to the internet (out of ~11,000 total including cloud). BeyondTrust serves 20,000+ customers across 100+ countries, including 75% of the Fortune 100, with heavy deployment in healthcare, financial services, government, and hospitality. The combination of trivial exploitation (single WebSock
Target sectors: Government, Financial Services, Healthcare, Technology, Hospitality, Critical Infrastructure
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 33 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-1731, CVE-2024-12356, CVE-2024-12686, CVE-2025-1094, T1190, T1059.004, T1098, T1136.002, T1219, T1078.002, T1036.003, T1087.002, T1082, T1135