BeyondTrust Remote Support & PRA Pre-Authentication Remote Code Execution via OS Command Injection (CVE-2026-1731)

BeyondTrust Remote Support & PRA Pre-Authentication Remote (TL-2026-0193), also tracked as BT26-02, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-03-07. It carries a reported China nexus and is not formally attributed, affects BeyondTrust Remote Support (RS), references 1 CVE (CVE-2026-1731), maps to 24 MITRE ATT&CK techniques (T1003, T1005, T1018), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-0193

Threat ID
TL-2026-0193
Also known as
BT26-02
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-03-07
Last reviewed
2026-03-07
Attribution confidence
NONE
Nation-state nexus
China
Motivation
FINANCIAL
Target sectors
financial-services, legal-services, high-technology, higher-education, wholesale-retail, healthcare, government, defense-contractors
Target regions
North America, Europe, Oceania
Detection rules
9
Indicators of compromise
33

Malware and tooling in BeyondTrust Remote Support & PRA Pre-Authentication Remote

Malware and tooling: SparkRAT, VShell

Critical pre-authentication remote code execution vulnerability (CVE-2026-1731, CVSS 9.8) in BeyondTrust Remote Support and Privileged Remote Access products via OS command injection in the thin-scc-wrapper WebSocket handler. Actively exploited in the wild with ransomware deployment, CISA KEV listed. Approximately 16,400 instances potentially vulnerable with 8,500 directly internet-exposed.

How BeyondTrust Remote Support & PRA Pre-Authentication Remote works

A critical pre-authentication remote code execution vulnerability (CVE-2026-1731) exists in BeyondTrust Remote Support (RS) versions 21.3 through 25.3.1 and Privileged Remote Access (PRA) versions 24.3.4 and prior. The flaw resides in the thin-scc-wrapper component, which handles incoming WebSocket connections and is directly exposed to the network. During the WebSocket handshake process, the application processes a client-supplied remoteVersion parameter intended for version compatibility validation. Due to insufficient input sanitization, the parameter value is passed into a Bash arithmetic evaluation context using (( ... )) or let constructs. Bash arithmetic contexts evaluate and execute embedded command substitutions such as $(command) before performing the comparison, enabling an unauthenticated remote attacker to inject and execute arbitrary operating system commands in the context of the site user.

The vulnerability was discovered on January 31, 2026, through AI-enabled variant analysis by researchers at Hacktron AI. CVE-2026-1731 is a variant of CVE-2024-12356, which affected the same thin-scc-wrapper component and was exploited by the Chinese state-sponsored group Silk Typhoon (APT27/Emissary Panda) in the December 2024 breach of the U.S. Department of the Treasury. Both vulnerabilities share the same WebSocket endpoint but exploit different code paths. The attack payload format leverages a[$(cmd)]0 to force arithmetic evaluation and execute arbitrary shell commands. BeyondTrust published security advisory BT26-02 on February 6, 2026, and SaaS customers were auto-patched on February 2, 2026.

A proof-of-concept exploit was published to GitHub on February 10, 2026, and active exploitation was observed within hours. By February 11, GreyNoise sensors detected a surge in reconnaissance scanning for vulnerable instances, with a single IP accounting for 86% of sessions via a commercial VPN service in Frankfurt. Two distinct exploit tools were identified via JA4+ fingerprinting: a lightweight 5-header variant shared among the top scanning IPs and an extended 7-header tool used by single-session scanners. CISA added CVE-2026-1731 to the Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026, with an accelerated federal remediation deadline of February 16. Approximately 16,400 instances were identified as potentially vulnerable by Palo Alto Networks Cortex Xpanse, with approximately 8,500 on-premises instances directly exposed to the internet.

Post-exploitation activity documented by Unit 42 includes deployment of VShell (a stealthy Linux backdoor with fileless memory execution capabilities), SparkRAT (a cross-platform open-source Go RAT), SimpleHelp and AnyDesk remote management tools, Cloudflare Tunnel for tunneling, Nezha monitoring agent, and Metasploit Meterpreter on default port 4444. Attackers deployed multiple web shells including one-line PHP eval shells, China Chopper/AntSword-style shells (aws.php), and a password-protected backdoor (file_save.php) using a config STOMPing technique to inject Apache Location directives, restart the service, then overwrite the configuration with a clean backup to evade forensic analysis.

A sophisticated Python-based account takeover script was observed that backs up the admin password hash (User ID 1), generates a new hash via the check_auth binary, injects it into the database, sleeps 60 seconds for attacker access, restores the original hash, and self-destructs. DNS exfiltration scripts were also deployed, converting hostnames to hexadecimal and transmitting via nslookup to attacker-controlled OAST domains with DNS label chunking to bypass strict resolvers. CISA subsequently updated the KEV entry to flag ransomware-related exploitation activity. Targeted sectors include financial services, legal services, high technology, higher education, wholesale/retail, and healthcare, with confirmed exploitation across the United States, France, Germany, Australia, and Canada.

---

**Revalidated on 2026-03-12**

Five weeks after initial disclosure, CVE-2026-1731 has proven to be one of the most consequential vulnerabilities of early 2026. The exploitation lifecycle has been remarkable for its speed: from AI-driven discovery on January 31, to SaaS auto-patching on February 2, to advisory publication on February 6, to PoC release and first exploitation on February 10, to confirmed mass exploitation by February 12 -- a compressed timeline that highlights the shrinking window between disclosure and weaponization.

Several significant developments have occurred since initial publication. First, BeyondTrust revised its advisory on February 13 to confirm exploitation was actually detected as far back as January 31, making CVE-2026-1731 a confirmed zero-day that was exploited for at least one week before patches reached SaaS customers. Second, the threat landscape has broadened considerably: Arctic Wolf documented campaigns using SimpleHelp RMM for persistence with renamed binaries in ProgramData directories, PSExec and Impacket SMBv2 for lateral movement, and domain account creation with Enterprise Admin group escalation. Darktrace independently observed OAST domain callbacks (oast.fun), suspicious executable downloads, outbound beaconing to rare domains, and even cryptocurrency mining activity across customer environments. Third, CISA's March 5 update to the KEV entry formally flagged ransomware campaign association, confirming that exploitation has escalated from opportunistic scanning to hands-on-keyboard ransomware operations. Defense contractors and local government organizations were specifically cited as active targets by March 6.

The international response has also expanded, with the NHS England National CSOC (CC-4743), Canadian Centre for Cyber Security (AL26-003), and H-ISAC all issuing dedicated advisories. Intel 471 published a notable analysis framing CVE-2026-1731 as a landmark case for AI-driven vulnerability research, given that the Hacktron autonomous agent discovered it through variant analysis of CVE-2024-12356 -- the same thin-scc-wrapper vulnerability that Silk Typhoon exploited in the 2024 US Treasury breach. This AI-augmented discovery approach is expected to accelerate similar findings in the future.

With approximately 8,500 on-premises instances still potentially unpatched and exploitation confirmed across at least six countries and eight industry verticals, this threat remains critical. Organizations running self-hosted BeyondTrust RS or PRA must upgrade to RS 25.3.2 or PRA 25.1.1 immediately and conduct thorough compromise assessments. Scanner coverage is now available from Tenable (Nessus plugin 298510), Rapid7 (InsightVM/Nexpose), and community Nuclei templates.

MITRE ATT&CK techniques used in TL-2026-0193

credential-access

T1003 OS Credential Dumping; T1552.001 Credentials In Files

collection

T1005 Data from Local System

discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1087.002 Domain Account

lateral-movement

T1021.002 SMB/Windows Admin Shares

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion; T1078.002 Domain Accounts

exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

execution

T1059.001 PowerShell; T1059.004 Unix Shell; T1059.006 Python

command-and-control

T1071.001 Web Protocols; T1071.004 DNS; T1219 Remote Access Tools; T1572 Protocol Tunneling

persistence

T1136.001 Local Account; T1136.002 Domain Account; T1505.003 Web Shell

initial-access

T1190 Exploit Public-Facing Application

impact

T1486 Data Encrypted for Impact

Affected products and versions in BeyondTrust Remote Support & PRA Pre-Authentication Remote

  • BeyondTrust — Remote Support (RS)
    Vulnerable versions: 21.3 through 25.3.1
    Fixed in: 25.3.2+
  • BeyondTrust — Privileged Remote Access (PRA)
    Vulnerable versions: 24.3.4 and prior
    Fixed in: 25.1.1+

Remediation for BeyondTrust Remote Support & PRA Pre-Authentication Remote

Patches

  • BeyondTrust Remote Support 25.3.2+ (Patch BT25-02-RS)
  • BeyondTrust Privileged Remote Access 25.1.1+
  • SaaS customers auto-patched as of February 2, 2026

Immediate actions

  • Patch BeyondTrust Remote Support to version 25.3.2 or later immediately
  • Patch BeyondTrust Privileged Remote Access to version 25.1.1 or later
  • Block all IOC IP addresses at network perimeter firewalls
  • Audit BeyondTrust appliance logs for anomalous WebSocket connections to thin-scc-wrapper
  • Search for web shells (maintenance.php, aws.php, file_save.php) in BeyondTrust web roots
  • Review local and domain account creation events for unauthorized accounts

Workarounds

  • Restrict network access to BeyondTrust appliances to trusted IP ranges only
  • Implement WAF rules to filter malicious remoteVersion parameter values in WebSocket handshakes
  • Monitor and block connections to known C2 infrastructure

Longer-term hardening

  • Deploy EDR with behavioral detection for bomgar-scc.exe spawning cmd.exe or powershell.exe
  • Implement network segmentation for privileged access management infrastructure
  • Enable enhanced logging for WebSocket connections on BeyondTrust appliances
  • Monitor for unauthorized account creation and privilege escalation to Domain Admins
  • Subscribe to automatic updates in BeyondTrust /appliance interface
  • Implement DNS monitoring for OAST and exfiltration patterns

CVEs associated with BeyondTrust Remote Support & PRA Pre-Authentication Remote

CVE-2026-1731

Weaknesses (CWE) in BeyondTrust Remote Support & PRA Pre-Authentication Remote

CWE-78

Timeline of BeyondTrust Remote Support & PRA Pre-Authentication Remote

Showing the 20 most recent tracked events.

  • Horizon3.ai publishes independent attack research with full technical analysis and exploit walkthrough for CVE-2026-1731 [Source: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-1731/]
  • First exploitation attempts observed in the wild within hours of PoC release
  • Proof-of-concept exploit published to GitHub by win3zz; trivial WebSocket message with crafted version string
  • GreyNoise Global Observation Grid detects reconnaissance scanning surge targeting vulnerable BeyondTrust instances
  • Arctic Wolf and watchTowr independently confirm mass exploitation of CVE-2026-1731 is underway with SimpleHelp RMM persistence and lateral movement [Source: https://arcticwolf.com/resources/blog/update-arctic-wolf-observes-threat-campaign-targeting-beyondtrust-remote-support-following-cve-2026-1731-poc-availability/]
  • Tenable publishes Nessus detection plugin 298510 for remote vulnerability scanning of BeyondTrust RS instances [Source: https://www.tenable.com/plugins/nessus/298510]
  • BeyondTrust updates advisory BT26-02 to confirm first exploitation was actually detected on January 31, establishing CVE-2026-1731 as a zero-day for at least one week prior to patch deployment [Source: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02]
  • CISA adds CVE-2026-1731 to Known Exploited Vulnerabilities catalog with accelerated remediation deadline of February 16
  • Palo Alto Networks Unit 42 publishes detailed exploitation analysis documenting VShell, SparkRAT, and web shell deployment
  • H-ISAC issues TLP White threat bulletin warning healthcare sector of active exploitation
  • Threat Intelligence Report publishes analysis documenting escalation from rapid scanning to ransomware-linked intrusions across financial services, legal, healthcare, and education sectors [Source: https://www.threatintelreport.com/2026/02/21/vulnerabilities_exploits/beyondtrust-cve-2026-1731-pre-auth-rce-escalates-from-rapid-scanning-to-ransomware-linked-intrusions/]
  • Ransomware-linked intrusions confirmed across financial services, legal, healthcare, and education sectors
  • Darktrace Threat Research team publishes analysis of exploitation wave across customer environments, documenting OAST callbacks, anomalous executable downloads, and C2 beaconing patterns [Source: https://www.darktrace.com/blog/cve-2026-1731-how-darktrace-sees-the-beyondtrust-exploitation-wave-unfolding]
  • Intel 471 publishes analysis highlighting CVE-2026-1731 as a landmark case for AI-driven vulnerability research and the implications for future variant analysis discovery [Source: https://www.intel471.com/blog/cve-2026-1731-finding-a-critical-rce-in-an-age-of-ai-driven-vulnerability-research]
  • Security Affairs reports continued ongoing attacks fueled by CVE-2026-1731 targeting remaining unpatched BeyondTrust instances across multiple industry verticals [Source: https://securityaffairs.com/188370/hacking/cve-2026-1731-fuels-ongoing-attacks-on-beyondtrust-remote-access-products.html]
  • CISA updates KEV catalog entry for CVE-2026-1731 with ransomware association flag, confirming hands-on-keyboard ransomware intrusion activity leveraging this vulnerability [Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731]
  • CISA updates KEV entry with ransomware association flag indicating hands-on-keyboard intrusion activity
  • SecurityWeek reports ransomware crews actively targeting defense contractors and local government organizations using CVE-2026-1731 as initial access vector [Source: https://www.securityweek.com/beyondtrust-vulnerability-exploited-in-ransomware-attacks/]
  • Continued active exploitation reported targeting defense contractors and local government organizations
  • As of 2026-05-29, CVE-2026-1731 is fully patched (RS 25.3.2+/PRA 25.1.1+, SaaS auto-patched Feb 2) yet remains CISA KEV-listed with a ransomware flag and exploitation continues against ~8,500 unpatched internet-exposed on-prem instances. No successor CVE supersedes it; PATCHED is correct while residual opportunistic exploitation of stragglers keeps it active.

Sources cited for BeyondTrust Remote Support & PRA Pre-Authentication Remote

Threats related to BeyondTrust Remote Support & PRA Pre-Authentication Remote

Detection coverage for TL-2026-0193

As of 2026-03-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0193 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats