BeyondTrust Pre-Auth RCE (CVE-2026-1731) — CVSS 9.9, CISA KEV, WebSocket Command Injection, VShell/SparkRAT, 16K+ Exposed Instances, Multi-Sector Campaign — Threadlinqs Intelligence
As of 2026-05-30, BeyondTrust Pre-Auth RCE (CVE-2026-1731) — CVSS 9.9, CISA KEV, WebSocket Command Injection, VShell/SparkRAT, 16K+ Exposed Instances, Multi-Sector Campaign is a critical-severity vulnerability threat attributed to a China-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 47 indicators of compromise.
Threat ID: TL-2026-0124 · Severity: CRITICAL · CVSS: 9.9 · Status: ACTIVE · Category: VULNERABILITY
Attribution: China · ESPIONAGE
CVE-2026-1731 is a critical pre-authentication remote code execution vulnerability (CVSS v4 9.9 / v3.1 9.8) in BeyondTrust Remote Support and Privileged Remote Access via OS command injection in the
On February 6, 2026, BeyondTrust released security advisory BT26-02 disclosing CVE-2026-1731, a critical pre-authentication remote code execution (RCE) vulnerability affecting BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). CISA added CVE-2026-1731 to the Known Exploited Vulnerabilities (KEV) Catalog on February 13, 2026, mandating federal agency remediation by February 16.
## Vulnerability Mechanism
CVE-2026-1731 is an OS command injection vulnerability (CWE-78) in the thin-scc-wrapper bash script, a component reachable via WebSocket connections on the /nw path or endpoints associated with get_portal_info. The flaw resides in how the script processes the remoteVersion parameter during the WebSocket handshake.
The script uses bash arithmetic contexts ((( ... )) or let) to compare version numbers. In bash, arithmetic contexts treat operands as expressions — not strictly integer values. If input is not rigorously sanitized, the arithmetic context will evaluate and execute embedded command substitutions (e.g., $(command)) before performing the intended comparison. The exploit payload format is a[$(cmd)]0, which forces arithmetic evaluation of the injected command.
While previous patches (addressing CVE-2024-12356) introduced numeric coherence checks, these measures were not comprehensive enough to prevent bash expression evaluation on the input string, leaving the endpoint exploitable.
### Exploitation Requirements
- **Authentication**: None required (pre-auth)
- **User Interaction**: None
- **Complexity**: Low — WebSocket connection + crafted remoteVersion value
- **Privileges**: Executes as "site user" (not root, but controls appliance configuration, sessions, and network traffic)
## Attack Chain (Observed by Unit 42)
Unit 42 (Palo Alto Networks) published detailed analysis on February 19, 2026, documenting active exploitation across multiple sectors:
### Phase 1: Initial Access
Attackers initiate a WebSocket connection to the target appliance (/nw endpoint) and inject a crafted remoteVersion value containing the command injection payload. Public PoC code (published to GitHub on February 10 by researcher win3zz) uses websocat to establish the WebSocket with the 'ingredi support desk customer thin' protocol.
### Phase 2: Administrative Account Takeover
A custom Python script performs temporary admin takeover — querying the application database to backup the existing password hash for User ID 1 (primary administrator), using the application's own check_auth binary to generate a hash for the password 'password', injecting it into the database, sleeping for 60 seconds, restoring the original hash, and self-destructing. This provides a 60-second window of administrative access while minimizing forensic artifacts.
### Phase 3: Persistence — Web Shells
Multiple web shell variants deployed:
- **One-line PHP web shell**: Uses eval() with POST['1'] parameter, gated by GET['aaaa'] parameter
- **Multi-vector PHP web shell (aws.php)**: Aggregates POST, GET, and Cookie data to locate 'ASS' parameter. Base64-decodes and eval()s payload. Echoes DQo= (CRLF) as data delimiters — signature of China Chopper / AntSword C2 tools
- **Config STOMPing bash dropper**: Writes password-protected PHP backdoor (file_save.php) to web root, injects malicious Location directive into Apache config, restarts Apache, then overwrites config with clean backup. Backdoor remains functional in running process while on-disk config appears clean — anti-forensic technique
### Phase 4: Backdoor and RAT Deployment
- **VShell**: Stealthy Linux backdoor/RAT with fileless memory execution, masquerades as legitimate system services
- **SparkRAT**: Cross-platform open-source RAT (Go), originally identified in 2023 DragonSpark attacks
- **Nezha monitoring agent**: Downloaded via PowerShell scripts
- **Multi-method download cradle**: Chains wget, curl, python, busybox to guarantee delivery across diverse Linux environments; retriev
Target sectors: financial-services, legal, technology, higher-education, wholesale-retail, healthcare
Target regions: United States, France, Germany, Australia, Canada
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 47 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-1731, T1190, T1059.004, T1059.001, T1203, T1505.003, T1098, T1136.001, T1136.002, T1078.003, T1070.004