# CVE-2026-1731 — BeyondTrust Pre-Auth RCE, CVSS 9.8, CISA KEV, Actively Exploited — Unauthenticated OS Command Injection in Remote Support & Privileged Remote Access, SimpleHelp RAT Post-Exploitation, Full Domain Control, Silk Typhoon Predecessor Chain

> Critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) via Bash arithmetic evaluation command injection in WebSocket-reachable thin-scc-wrapper script, actively exploited with public PoC, CISA KEV listed, variant of CVE-2024-12356 used by Silk Typhoon to breach U.S. Treasury

- **Published:** 2026-02-16T07:42:00Z
- **Last reviewed:** 2026-02-16T07:42:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0110
- **ID:** TL-2026-0110
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-1731, CVE-2024-12356, CVE-2024-12686, CVE-2025-1094

## Description

CVE-2026-1731 is a critical pre-authentication OS command injection vulnerability (CVSS 4.0: 9.9, CWE-78) in BeyondTrust Remote Support (RS) versions ≤25.3.1 and Privileged Remote Access (PRA) versions ≤24.3.4. The vulnerability exists in the thin-scc-wrapper Bash script, which processes attacker-controlled input (the remoteVersion value) from WebSocket connections to the /nw endpoint. Bash arithmetic evaluation in the [[ $localVersion -lt $remoteVersion ]] comparison treats operands as expressions rather than plain strings, allowing payloads like a[$(cmd)]0 to achieve arbitrary command execution as the SYSTEM site user — without authentication or user interaction.

This is a direct variant of CVE-2024-12356, which was exploited as a zero-day by Chinese state-sponsored group Silk Typhoon (Storm-0558) to breach the U.S. Treasury Department in December 2024, accessing OFAC sanctions data and other sensitive government information. Both vulnerabilities target the exact same WebSocket endpoint (/nw) and the same thin-scc-wrapper script. While BeyondTrust added a numeric sanity check (regex validation for 1-2 digit numbers) in the CVE-2026-1731 patch, the check was insufficient — Bash still performs expression evaluation on the operands even after regex validation, leaving the endpoint exploitable through a different code path.

The vulnerability was discovered on January 31, 2026 by Hacktron AI using AI-enabled variant analysis capabilities. Notably, the discovery came one day after watchTowr published analysis of CVE-2026-1281 in Ivanti EPMM, which exploits the identical Bash arithmetic evaluation primitive — suggesting cross-pollination between vulnerability research streams. BeyondTrust responded rapidly: cloud/SaaS instances were auto-patched by February 2, 2026 (2-day turnaround). Self-hosted customers must manually apply patches BT26-02-RS or BT26-02-PRA.

The patch itself was reverse-engineered by Rapid7, who demonstrated that BT26-02-RS.nss is encrypted with a static key ('Bingb0ng, what she said; the Tw1st3d switch is RED') using AES-256-CBC — meaning any attacker who knows this key can extract and diff the patch to construct an exploit. A public proof-of-concept was published on GitHub (win3zz/CVE-2026-1731) on February 10, 2026. Within 24 hours, GreyNoise observed active reconnaissance scanning for vulnerable instances.

Arctic Wolf has confirmed active exploitation campaigns against self-hosted BeyondTrust Remote Support deployments. Observed TTPs include: SimpleHelp RMM tool deployment for persistence (renamed binaries saved to C:\ProgramData and executed as SYSTEM via Bomgar processes), domain admin account creation via 'net user' and 'net group' commands, Active Directory enumeration via AdsiSearcher, PsExec lateral movement across domain, and Impacket SMBv2 session setup requests. This post-exploitation playbook closely mirrors enterprise ransomware precursor activity.

GreyNoise analysis reveals sophisticated reconnaissance: a single IP accounts for 86% of scanning sessions, operating through a Frankfurt-based commercial VPN service (MSS 1358 confirming VPN tunnel encapsulation). Scanners deliberately target non-standard ports (not just 443), knowing enterprises move BeyondTrust to non-default ports. JA4+ fingerprinting identifies two distinct exploit tools — a 5-header variant used by the top 5 IPs (all classified malicious) and a 7-header variant used by 10 single-session scanners. These same IPs simultaneously exploit SonicWall, MOVEit Transfer, Log4j, Sophos firewalls, and perform SSH brute-forcing — indicating multi-exploit threat actors.

Hacktron AI identified approximately 8,500 self-hosted BeyondTrust instances exposed to the internet (out of ~11,000 total including cloud). BeyondTrust serves 20,000+ customers across 100+ countries, including 75% of the Fortune 100, with heavy deployment in healthcare, financial services, government, and hospitality. The combination of trivial exploitation (single WebSocket message), SYSTEM-level access, and the product's role managing privileged access makes this one of the highest-impact vulnerabilities of 2026.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1098 Account Manipulation
- T1136.002 Domain Account
- T1219 Remote Access Tools
- T1078.002 Domain Accounts
- T1036.003 Rename Legitimate Utilities
- T1087.002 Domain Account
- T1082 System Information Discovery
- T1135 Network Share Discovery
- T1018 Remote System Discovery
- T1021.002 SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1071.001 Web Protocols
- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal
- T1059.003 Windows Command Shell
- T1136.001 Local Account
- T1003.001 LSASS Memory
- T1213 Data from Information Repositories
- T1555 Credentials from Password Stores
- T1213.003 Code Repositories
- T1686 Disable or Modify System Firewall
- T1098.003 Additional Cloud Roles
- T1069.002 Domain Groups

## Sources

- [BeyondTrust Security Advisory BT26-02](https://www.beyondtrust.com/trust-center/security-advisories/bt26-02)
- [Rapid7 AttackerKB Technical Analysis](https://attackerkb.com/topics/jNMBccstay/cve-2026-1731/rapid7-analysis)
- [Rapid7 ETR Blog](https://www.rapid7.com/blog/post/etr-cve-2026-1731-critical-unauthenticated-remote-code-execution-rce-beyondtrust-remote-support-rs-privileged-remote-access-pra/)
- [Hacktron AI Discovery Advisory](https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce)
- [Arctic Wolf Active Exploitation Bulletin](https://arcticwolf.com/resources/blog/update-arctic-wolf-observes-threat-campaign-targeting-beyondtrust-remote-support-following-cve-2026-1731-poc-availability/)
- [GreyNoise Reconnaissance Analysis](https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731)
- [CISA KEV Listing](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731)
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-1731)
- [Public PoC Exploit](https://github.com/win3zz/CVE-2026-1731)
- [watchTowr Bash Arithmetic Evaluation Research (Ivanti EPMM)](https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0110