# BeyondTrust Pre-Auth RCE (CVE-2026-1731) — CVSS 9.9, CISA KEV, WebSocket Command Injection, VShell/SparkRAT, 16K+ Exposed Instances, Multi-Sector Campaign

> CVE-2026-1731 is a critical pre-authentication remote code execution vulnerability (CVSS v4 9.9 / v3.1 9.8) in BeyondTrust Remote Support and Privileged Remote Access via OS command injection in the thin-scc-wrapper bash script. Bash arithmetic evaluation of unsanitized remoteVersion input during WebSocket handshake enables unauthenticated arbitrary command execution as the site user. CISA added to KEV on 2026-02-13. Unit 42 observed active multi-sector exploitation deploying VShell, SparkRAT, PHP webshells, with lateral movement via SimpleHelp, AnyDesk, Cloudflare tunnels, and Ligolo-ng. 16,400+ exposed instances identified by Cortex Xpanse. Variant of CVE-2024-12356, previously exploited by Silk Typhoon to breach the U.S. Treasury.

- **Published:** 2026-02-21T12:00:00Z
- **Last reviewed:** 2026-02-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0124
- **ID:** TL-2026-0124
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-1731, CVE-2024-12356

## Description

On February 6, 2026, BeyondTrust released security advisory BT26-02 disclosing CVE-2026-1731, a critical pre-authentication remote code execution (RCE) vulnerability affecting BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). CISA added CVE-2026-1731 to the Known Exploited Vulnerabilities (KEV) Catalog on February 13, 2026, mandating federal agency remediation by February 16.

## Vulnerability Mechanism

CVE-2026-1731 is an OS command injection vulnerability (CWE-78) in the thin-scc-wrapper bash script, a component reachable via WebSocket connections on the /nw path or endpoints associated with get_portal_info. The flaw resides in how the script processes the remoteVersion parameter during the WebSocket handshake.

The script uses bash arithmetic contexts ((( ... )) or let) to compare version numbers. In bash, arithmetic contexts treat operands as expressions — not strictly integer values. If input is not rigorously sanitized, the arithmetic context will evaluate and execute embedded command substitutions (e.g., $(command)) before performing the intended comparison. The exploit payload format is a[$(cmd)]0, which forces arithmetic evaluation of the injected command.

While previous patches (addressing CVE-2024-12356) introduced numeric coherence checks, these measures were not comprehensive enough to prevent bash expression evaluation on the input string, leaving the endpoint exploitable.

### Exploitation Requirements
- **Authentication**: None required (pre-auth)
- **User Interaction**: None
- **Complexity**: Low — WebSocket connection + crafted remoteVersion value
- **Privileges**: Executes as "site user" (not root, but controls appliance configuration, sessions, and network traffic)

## Attack Chain (Observed by Unit 42)

Unit 42 (Palo Alto Networks) published detailed analysis on February 19, 2026, documenting active exploitation across multiple sectors:

### Phase 1: Initial Access
Attackers initiate a WebSocket connection to the target appliance (/nw endpoint) and inject a crafted remoteVersion value containing the command injection payload. Public PoC code (published to GitHub on February 10 by researcher win3zz) uses websocat to establish the WebSocket with the 'ingredi support desk customer thin' protocol.

### Phase 2: Administrative Account Takeover
A custom Python script performs temporary admin takeover — querying the application database to backup the existing password hash for User ID 1 (primary administrator), using the application's own check_auth binary to generate a hash for the password 'password', injecting it into the database, sleeping for 60 seconds, restoring the original hash, and self-destructing. This provides a 60-second window of administrative access while minimizing forensic artifacts.

### Phase 3: Persistence — Web Shells
Multiple web shell variants deployed:
- **One-line PHP web shell**: Uses eval() with POST['1'] parameter, gated by GET['aaaa'] parameter
- **Multi-vector PHP web shell (aws.php)**: Aggregates POST, GET, and Cookie data to locate 'ASS' parameter. Base64-decodes and eval()s payload. Echoes DQo= (CRLF) as data delimiters — signature of China Chopper / AntSword C2 tools
- **Config STOMPing bash dropper**: Writes password-protected PHP backdoor (file_save.php) to web root, injects malicious Location directive into Apache config, restarts Apache, then overwrites config with clean backup. Backdoor remains functional in running process while on-disk config appears clean — anti-forensic technique

### Phase 4: Backdoor and RAT Deployment
- **VShell**: Stealthy Linux backdoor/RAT with fileless memory execution, masquerades as legitimate system services
- **SparkRAT**: Cross-platform open-source RAT (Go), originally identified in 2023 DragonSpark attacks
- **Nezha monitoring agent**: Downloaded via PowerShell scripts
- **Multi-method download cradle**: Chains wget, curl, python, busybox to guarantee delivery across diverse Linux environments; retrieves blue.drx from legitimate file transfer service, pipes to sh
- **Meterpreter**: Reverse shells on port 4444 (default Metasploit)

### Phase 5: Lateral Movement
- SimpleHelp and AnyDesk remote management tool installation
- Cloudflare tunnel deployment for persistent access
- Domain account and local administrator account creation
- Domain admin and trust reconnaissance

### Phase 6: Defense Evasion — DNS Tunneling
Out-of-band (OAST) techniques targeting Burp Suite Collaborator (oastify[.]com). Hostname encoded to hexadecimal, transmitted via nslookup queries as subdomains of attacker OAST domain. PowerShell variant handles BitConverter encoding and DNS label limits (63-character chunking).

### Phase 7: Data Exfiltration
Configuration files, internal system databases, and full PostgreSQL dumps staged, compressed, and transmitted to attacker-controlled C2 servers via the remoteVersion injection chain.

## Reconnaissance Activity (GreyNoise)

GreyNoise's Global Observation Grid detected reconnaissance probing within 24 hours of PoC publication on February 10. Key findings:
- A single IP accounted for 86% of all reconnaissance sessions — associated with a commercial VPN service in Frankfurt, active scanner since 2023
- Attackers systematically probed non-standard ports (not just 443), indicating knowledge that enterprises move BeyondTrust to non-default ports
- JA4+ fingerprints reveal shared tooling: 100% Linux stack, MSS of 1358 confirming VPN tunnel encapsulation, two distinct exploit tools (5-header and 7-header variants), neither matching known applications
- Scanning IPs simultaneously targeting SonicWall, MOVEit Transfer, Log4j, Sophos firewalls, SSH brute-forcing, and IoT default credentials — multi-exploit actors

## Historical Context — Silk Typhoon and CVE-2024-12356

CVE-2026-1731 is a variant of CVE-2024-12356, the same vulnerability class in the same WebSocket endpoint (thin-scc-wrapper). CVE-2024-12356 was exploited by Silk Typhoon (APT27/UNC5221/Emissary Panda) in late 2024 to breach the U.S. Treasury Department. In January 2026, GreyNoise observed a Polish hosting provider replaying the exact Treasury breach exploit chain (CVE-2024-12356 + CVE-2025-1094 SQLi), indicating the old chain remained in active use even before CVE-2026-1731 was discovered.

## Exposure and Impact

Palo Alto Networks Cortex Xpanse identified 16,400+ exposed BeyondTrust instances vulnerable to CVE-2026-1731. Affected sectors include financial services, legal services, high technology, higher education, wholesale/retail, and healthcare across the United States, France, Germany, Australia, and Canada. BeyondTrust's remote access tools occupy a uniquely sensitive position — designed to manage privileged access to enterprise networks, their compromise provides attackers not just a foothold but the keys to the castle.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1203 Exploitation for Client Execution
- T1505.003 Web Shell
- T1098 Account Manipulation
- T1136.001 Local Account
- T1136.002 Domain Account
- T1078.003 Local Accounts
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1087.002 Domain Account
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021 Remote Services
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071.001 Web Protocols
- T1071.004 DNS
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1583.003 Virtual Private Server
- T1587.004 Exploits
- T1588.002 Tool
- T1070.006 Timestomp
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

## Sources

- [Unit 42: VShell and SparkRAT Observed in Exploitation of BeyondTrust CVE-2026-1731](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/)
- [BeyondTrust Security Advisory BT26-02 — CVE-2026-1731](https://www.beyondtrust.com/trust-center/security-advisories/bt26-02)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-1731](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731)
- [NVD — CVE-2026-1731 (CVSS 4.0: 9.9, CWE-78 OS Command Injection)](https://nvd.nist.gov/vuln/detail/CVE-2026-1731)
- [GreyNoise: Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731)](https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731)
- [win3zz/CVE-2026-1731 — Public PoC Exploit (GitHub)](https://github.com/win3zz/CVE-2026-1731)
- [BeyondTrust Knowledge Base — KB0023293 (Patch Instructions)](https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293)
- [Trellix: The Silent Fileless Threat of VShell](https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/)
- [NVISO: VShell Linux Backdoor Analysis (PDF)](https://blog.nviso.eu/wp-content/uploads/2025/11/VShell.pdf)
- [SentinelOne: DragonSpark Attacks with SparkRAT and Golang Source Code Interpretation](https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/)
- [U.S. DOJ: Charges Against 12 Chinese Contract Hackers (Silk Typhoon / BeyondTrust Treasury Breach)](https://www.justice.gov/opa/pr/justice-department-charges-12-chinese-contract-hackers-and-law-enforcement-officers-global)
- [BeyondTrust: Remote Support SaaS Service Security Investigation (CVE-2024-12356 Incident)](https://www.beyondtrust.com/remote-support-saas-service-security-investigation)
- [CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)](https://cwe.mitre.org/data/definitions/78.html)
- [GNU Bash Manual: Arithmetic Expansion (Root Cause Context)](https://www.gnu.org/software/bash/manual/html_node/Arithmetic-Expansion.html)
- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0124