BeyondTrust Pre-Auth RCE (CVE-2026-1731) — CVSS 9.9, CISA KEV, WebSocket Command Injection, VShell/SparkRAT, 16K+ Exposed Instances, Multi-Sector Campaign

BeyondTrust Pre-Auth RCE (CVE-2026-1731) (TL-2026-0124), also tracked as BT26-02, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-02-21. It carries a reported China nexus and is not formally attributed, affects BeyondTrust Remote Support (RS), references 1 CVE (CVE-2026-1731), maps to 33 MITRE ATT&CK techniques (T1005, T1018, T1021), and is covered by 9 detection rules and 47 indicators of compromise.

Key facts for TL-2026-0124

Threat ID
TL-2026-0124
Also known as
BT26-02
Severity
CRITICAL
CVSS
9.9
Status
ACTIVE
Category
VULNERABILITY
First published
2026-02-21
Last reviewed
2026-02-21
Attribution confidence
NONE
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
financial-services, legal, technology, higher-education, wholesale-retail, healthcare
Target regions
United States, France, Germany, Australia, Canada
Detection rules
9
Indicators of compromise
47

Malware and tooling in BeyondTrust Pre-Auth RCE (CVE-2026-1731)

Malware and tooling: SparkRAT, VShell, Antsword, AnyDesk, Havoc, Meterpreter, NetSupport Manager

CVE-2026-1731 is a critical pre-authentication remote code execution vulnerability (CVSS v4 9.9 / v3.1 9.8) in BeyondTrust Remote Support and Privileged Remote Access via OS command injection in the thin-scc-wrapper bash script. Bash arithmetic evaluation of unsanitized remoteVersion input during WebSocket handshake enables unauthenticated arbitrary command execution as the site user. CISA added to KEV on 2026-02-13. Unit 42 observed active multi-sector exploitation deploying VShell, SparkRAT, PHP webshells, with lateral movement via SimpleHelp, AnyDesk, Cloudflare tunnels, and Ligolo-ng. 16,400+ exposed instances identified by Cortex Xpanse. Variant of CVE-2024-12356, previously exploited by Silk Typhoon to breach the U.S. Treasury.

How BeyondTrust Pre-Auth RCE (CVE-2026-1731) works

On February 6, 2026, BeyondTrust released security advisory BT26-02 disclosing CVE-2026-1731, a critical pre-authentication remote code execution (RCE) vulnerability affecting BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). CISA added CVE-2026-1731 to the Known Exploited Vulnerabilities (KEV) Catalog on February 13, 2026, mandating federal agency remediation by February 16.

## Vulnerability Mechanism

CVE-2026-1731 is an OS command injection vulnerability (CWE-78) in the thin-scc-wrapper bash script, a component reachable via WebSocket connections on the /nw path or endpoints associated with get_portal_info. The flaw resides in how the script processes the remoteVersion parameter during the WebSocket handshake.

The script uses bash arithmetic contexts ((( ... )) or let) to compare version numbers. In bash, arithmetic contexts treat operands as expressions — not strictly integer values. If input is not rigorously sanitized, the arithmetic context will evaluate and execute embedded command substitutions (e.g., $(command)) before performing the intended comparison. The exploit payload format is a[$(cmd)]0, which forces arithmetic evaluation of the injected command.

While previous patches (addressing CVE-2024-12356) introduced numeric coherence checks, these measures were not comprehensive enough to prevent bash expression evaluation on the input string, leaving the endpoint exploitable.

### Exploitation Requirements - **Authentication**: None required (pre-auth) - **User Interaction**: None - **Complexity**: Low — WebSocket connection + crafted remoteVersion value - **Privileges**: Executes as "site user" (not root, but controls appliance configuration, sessions, and network traffic)

## Attack Chain (Observed by Unit 42)

Unit 42 (Palo Alto Networks) published detailed analysis on February 19, 2026, documenting active exploitation across multiple sectors:

### Phase 1: Initial Access Attackers initiate a WebSocket connection to the target appliance (/nw endpoint) and inject a crafted remoteVersion value containing the command injection payload. Public PoC code (published to GitHub on February 10 by researcher win3zz) uses websocat to establish the WebSocket with the 'ingredi support desk customer thin' protocol.

### Phase 2: Administrative Account Takeover A custom Python script performs temporary admin takeover — querying the application database to backup the existing password hash for User ID 1 (primary administrator), using the application's own check_auth binary to generate a hash for the password 'password', injecting it into the database, sleeping for 60 seconds, restoring the original hash, and self-destructing. This provides a 60-second window of administrative access while minimizing forensic artifacts.

### Phase 3: Persistence — Web Shells Multiple web shell variants deployed: - **One-line PHP web shell**: Uses eval() with POST['1'] parameter, gated by GET['aaaa'] parameter - **Multi-vector PHP web shell (aws.php)**: Aggregates POST, GET, and Cookie data to locate 'ASS' parameter. Base64-decodes and eval()s payload. Echoes DQo= (CRLF) as data delimiters — signature of China Chopper / AntSword C2 tools - **Config STOMPing bash dropper**: Writes password-protected PHP backdoor (file_save.php) to web root, injects malicious Location directive into Apache config, restarts Apache, then overwrites config with clean backup. Backdoor remains functional in running process while on-disk config appears clean — anti-forensic technique

### Phase 4: Backdoor and RAT Deployment - **VShell**: Stealthy Linux backdoor/RAT with fileless memory execution, masquerades as legitimate system services - **SparkRAT**: Cross-platform open-source RAT (Go), originally identified in 2023 DragonSpark attacks - **Nezha monitoring agent**: Downloaded via PowerShell scripts - **Multi-method download cradle**: Chains wget, curl, python, busybox to guarantee delivery across diverse Linux environments; retrieves blue.drx from legitimate file transfer service, pipes to sh - **Meterpreter**: Reverse shells on port 4444 (default Metasploit)

### Phase 5: Lateral Movement - SimpleHelp and AnyDesk remote management tool installation - Cloudflare tunnel deployment for persistent access - Domain account and local administrator account creation - Domain admin and trust reconnaissance

### Phase 6: Defense Evasion — DNS Tunneling Out-of-band (OAST) techniques targeting Burp Suite Collaborator (oastify[.]com). Hostname encoded to hexadecimal, transmitted via nslookup queries as subdomains of attacker OAST domain. PowerShell variant handles BitConverter encoding and DNS label limits (63-character chunking).

### Phase 7: Data Exfiltration Configuration files, internal system databases, and full PostgreSQL dumps staged, compressed, and transmitted to attacker-controlled C2 servers via the remoteVersion injection chain.

## Reconnaissance Activity (GreyNoise)

GreyNoise's Global Observation Grid detected reconnaissance probing within 24 hours of PoC publication on February 10. Key findings: - A single IP accounted for 86% of all reconnaissance sessions — associated with a commercial VPN service in Frankfurt, active scanner since 2023 - Attackers systematically probed non-standard ports (not just 443), indicating knowledge that enterprises move BeyondTrust to non-default ports - JA4+ fingerprints reveal shared tooling: 100% Linux stack, MSS of 1358 confirming VPN tunnel encapsulation, two distinct exploit tools (5-header and 7-header variants), neither matching known applications - Scanning IPs simultaneously targeting SonicWall, MOVEit Transfer, Log4j, Sophos firewalls, SSH brute-forcing, and IoT default credentials — multi-exploit actors

## Historical Context — Silk Typhoon and CVE-2024-12356

CVE-2026-1731 is a variant of CVE-2024-12356, the same vulnerability class in the same WebSocket endpoint (thin-scc-wrapper). CVE-2024-12356 was exploited by Silk Typhoon (APT27/UNC5221/Emissary Panda) in late 2024 to breach the U.S. Treasury Department. In January 2026, GreyNoise observed a Polish hosting provider replaying the exact Treasury breach exploit chain (CVE-2024-12356 + CVE-2025-1094 SQLi), indicating the old chain remained in active use even before CVE-2026-1731 was discovered.

## Exposure and Impact

Palo Alto Networks Cortex Xpanse identified 16,400+ exposed BeyondTrust instances vulnerable to CVE-2026-1731. Affected sectors include financial services, legal services, high technology, higher education, wholesale/retail, and healthcare across the United States, France, Germany, Australia, and Canada. BeyondTrust's remote access tools occupy a uniquely sensitive position — designed to manage privileged access to enterprise networks, their compromise provides attackers not just a foothold but the keys to the castle.

MITRE ATT&CK techniques used in TL-2026-0124

collection

T1005 Data from Local System; T1213 Data from Information Repositories

discovery

T1018 Remote System Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery

lateral-movement

T1021 Remote Services; T1021.001 Remote Desktop Protocol

defense-evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1070.006 Timestomp; T1078.003 Local Accounts

exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

execution

T1059.001 PowerShell; T1059.004 Unix Shell; T1203 Exploitation for Client Execution

command-and-control

T1071.001 Web Protocols; T1071.004 DNS; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1572 Protocol Tunneling

persistence

T1098 Account Manipulation; T1136.001 Local Account; T1136.002 Domain Account; T1505.003 Web Shell

initial-access

T1190 Exploit Public-Facing Application

credential-access

T1552.001 Credentials In Files; T1555 Credentials from Password Stores

resource-development

T1583.003 Virtual Private Server; T1587.004 Exploits; T1588.002 Tool

Affected products and versions in BeyondTrust Pre-Auth RCE (CVE-2026-1731)

  • BeyondTrust — Remote Support (RS)
    Vulnerable versions: 21.3.x through 25.3.1
    Fixed in: 25.3.2
  • BeyondTrust — Privileged Remote Access (PRA)
    Vulnerable versions: 22.1.x through 24.3.4
    Fixed in: 25.1.1

Remediation for BeyondTrust Pre-Auth RCE (CVE-2026-1731)

Patches

  • BeyondTrust Remote Support: upgrade to v25.3.2+ (patch BT26-02-RS)
  • BeyondTrust Privileged Remote Access: upgrade to v25.1.1+ (patch BT26-02-PRA)
  • Older versions: RS older than 21.3 or PRA older than 22.1 must upgrade to newer major version first
  • SaaS customers: automatically patched as of 2026-02-02

Immediate actions

  • Patch all BeyondTrust Remote Support instances to v25.3.2 or later
  • Patch all BeyondTrust Privileged Remote Access instances to v25.1.1 or later
  • If self-hosted and not subscribed to auto-updates, apply patches BT26-02-RS / BT26-02-PRA immediately
  • Block WebSocket connections to /nw endpoint from untrusted sources at WAF/reverse proxy
  • Audit Apache configuration for injected Location directives (config STOMPing technique)
  • Search for PHP webshells: aws.php, file_save.php, maintenance.php in web directories
  • Check for temporary admin account modifications in BeyondTrust database (User ID 1 hash changes)
  • Monitor for unauthorized SimpleHelp, AnyDesk, or Cloudflare tunnel installations

Workarounds

  • Restrict network access to BeyondTrust appliance management interface to trusted admin IPs only
  • Block external WebSocket connections to /nw and /get_portal_info endpoints at perimeter firewall
  • Implement strict DNS filtering blocking known OAST domains
  • Disable SSH and remote management protocols on appliance if not actively required

Longer-term hardening

  • Restrict BeyondTrust management interface to internal segmented networks or zero trust gateways
  • Implement WAF rules blocking crafted WebSocket handshakes with non-numeric remoteVersion values
  • Forward all BeyondTrust appliance logs to centralized SIEM
  • Enable GreyNoise or similar threat intelligence feeds for IOC blocking
  • Monitor for DNS tunneling to OAST domains (oastify.com, oast.pro, oast.fun)
  • Implement strict egress filtering preventing appliance outbound connections to unknown destinations
  • Conduct purple team exercises testing detection coverage for BeyondTrust exploitation chain
  • Subscribe to BeyondTrust automatic updates for self-hosted instances

CVEs associated with BeyondTrust Pre-Auth RCE (CVE-2026-1731)

CVE-2026-1731

Weaknesses (CWE) in BeyondTrust Pre-Auth RCE (CVE-2026-1731)

CWE-78

Timeline of BeyondTrust Pre-Auth RCE (CVE-2026-1731)

  • Silk Typhoon (APT27/UNC5221) exploits CVE-2024-12356 to breach the U.S. Treasury Department via BeyondTrust Remote Support. Same thin-scc-wrapper WebSocket endpoint as CVE-2026-1731. BeyondTrust begins incident investigation. Source: https://www.beyondtrust.com/remote-support-saas-service-security-investigation
  • U.S. DOJ announces charges against 12 Chinese contract hackers and law enforcement officers linked to Silk Typhoon/APT27 campaigns including the BeyondTrust Treasury breach. Source: https://www.justice.gov/opa/pr/justice-department-charges-12-chinese-contract-hackers-and-law-enforcement-officers-global
  • GreyNoise observes a Polish hosting provider replaying the exact Treasury breach exploit chain (CVE-2024-12356 + CVE-2025-1094 SQLi) targeting the /nw WebSocket path on port 443 — demonstrating the old chain remains in active use. Source: https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731
  • BeyondTrust applies automatic patch to all Remote Support SaaS and Privileged Remote Access SaaS customers remediating CVE-2026-1731.
  • BeyondTrust publishes security advisory BT26-02 disclosing CVE-2026-1731 — critical pre-authentication RCE via WebSocket command injection in thin-scc-wrapper. Self-hosted customers advised to manually patch to RS v25.3.2+ or PRA v25.1.1+. Source: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
  • Researcher win3zz publishes public PoC exploit for CVE-2026-1731 to GitHub. PoC uses websocat with 'ingredi support desk customer thin' protocol, payload format a[$(cmd)]0. Source: https://github.com/win3zz/CVE-2026-1731
  • GreyNoise Global Observation Grid detects reconnaissance probing for CVE-2026-1731 within 24 hours of PoC publication. Single IP accounts for 86% of scanning activity. Non-standard ports targeted. JA4+ fingerprints reveal shared tooling. Source: https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731
  • CISA adds CVE-2026-1731 to Known Exploited Vulnerabilities (KEV) Catalog. Remediation deadline: February 16, 2026 (3 days). Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • Unit 42 (Palo Alto Networks) publishes detailed analysis of active exploitation campaign: VShell, SparkRAT, web shells (China Chopper/AntSword signatures), config STOMPing, DNS tunneling via OAST, temp admin takeover script, lateral movement via SimpleHelp/AnyDesk/Cloudflare tunnels. Multi-sector: financial, legal, tech, education, healthcare across US/FR/DE/AU/CA. 16,400+ exposed instances. Source: https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/
  • Threadlinqs Intelligence publishes TL-2026-0124 with full analysis of CVE-2026-1731 exploitation campaign, complete MITRE ATT&CK mapping, 9 detections, and simulation scenarios.
  • As of 2026-05-29, CVE-2026-1731 remains actively exploited despite an available patch (SaaS auto-fixed 2026-02-02; self-hosted RS 25.3.2/PRA 25.1.1). It stays on CISA KEV with the entry updated to flag ransomware use, ~8,500 on-prem instances still exposed, and ongoing in-the-wild attacks per Arctic Wolf, GreyNoise, watchTowr and Unit 42 with no actor disruption.

Sources cited for BeyondTrust Pre-Auth RCE (CVE-2026-1731)

Threats related to BeyondTrust Pre-Auth RCE (CVE-2026-1731)

Detection coverage for TL-2026-0124

As of 2026-02-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0124 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats