# BeyondTrust Remote Support & PRA Pre-Authentication Remote Code Execution via OS Command Injection (CVE-2026-1731)

> Critical pre-authentication remote code execution vulnerability (CVE-2026-1731, CVSS 9.8) in BeyondTrust Remote Support and Privileged Remote Access products via OS command injection in the thin-scc-wrapper WebSocket handler. Actively exploited in the wild with ransomware deployment, CISA KEV listed. Approximately 16,400 instances potentially vulnerable with 8,500 directly internet-exposed.

- **Published:** 2026-03-07T12:00:00Z
- **Last reviewed:** 2026-03-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0193
- **ID:** TL-2026-0193
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-1731, CVE-2024-12356

## Description

A critical pre-authentication remote code execution vulnerability (CVE-2026-1731) exists in BeyondTrust Remote Support (RS) versions 21.3 through 25.3.1 and Privileged Remote Access (PRA) versions 24.3.4 and prior. The flaw resides in the thin-scc-wrapper component, which handles incoming WebSocket connections and is directly exposed to the network. During the WebSocket handshake process, the application processes a client-supplied remoteVersion parameter intended for version compatibility validation. Due to insufficient input sanitization, the parameter value is passed into a Bash arithmetic evaluation context using (( ... )) or let constructs. Bash arithmetic contexts evaluate and execute embedded command substitutions such as $(command) before performing the comparison, enabling an unauthenticated remote attacker to inject and execute arbitrary operating system commands in the context of the site user.

The vulnerability was discovered on January 31, 2026, through AI-enabled variant analysis by researchers at Hacktron AI. CVE-2026-1731 is a variant of CVE-2024-12356, which affected the same thin-scc-wrapper component and was exploited by the Chinese state-sponsored group Silk Typhoon (APT27/Emissary Panda) in the December 2024 breach of the U.S. Department of the Treasury. Both vulnerabilities share the same WebSocket endpoint but exploit different code paths. The attack payload format leverages a[$(cmd)]0 to force arithmetic evaluation and execute arbitrary shell commands. BeyondTrust published security advisory BT26-02 on February 6, 2026, and SaaS customers were auto-patched on February 2, 2026.

A proof-of-concept exploit was published to GitHub on February 10, 2026, and active exploitation was observed within hours. By February 11, GreyNoise sensors detected a surge in reconnaissance scanning for vulnerable instances, with a single IP accounting for 86% of sessions via a commercial VPN service in Frankfurt. Two distinct exploit tools were identified via JA4+ fingerprinting: a lightweight 5-header variant shared among the top scanning IPs and an extended 7-header tool used by single-session scanners. CISA added CVE-2026-1731 to the Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026, with an accelerated federal remediation deadline of February 16. Approximately 16,400 instances were identified as potentially vulnerable by Palo Alto Networks Cortex Xpanse, with approximately 8,500 on-premises instances directly exposed to the internet.

Post-exploitation activity documented by Unit 42 includes deployment of VShell (a stealthy Linux backdoor with fileless memory execution capabilities), SparkRAT (a cross-platform open-source Go RAT), SimpleHelp and AnyDesk remote management tools, Cloudflare Tunnel for tunneling, Nezha monitoring agent, and Metasploit Meterpreter on default port 4444. Attackers deployed multiple web shells including one-line PHP eval shells, China Chopper/AntSword-style shells (aws.php), and a password-protected backdoor (file_save.php) using a config STOMPing technique to inject Apache Location directives, restart the service, then overwrite the configuration with a clean backup to evade forensic analysis.

A sophisticated Python-based account takeover script was observed that backs up the admin password hash (User ID 1), generates a new hash via the check_auth binary, injects it into the database, sleeps 60 seconds for attacker access, restores the original hash, and self-destructs. DNS exfiltration scripts were also deployed, converting hostnames to hexadecimal and transmitting via nslookup to attacker-controlled OAST domains with DNS label chunking to bypass strict resolvers. CISA subsequently updated the KEV entry to flag ransomware-related exploitation activity. Targeted sectors include financial services, legal services, high technology, higher education, wholesale/retail, and healthcare, with confirmed exploitation across the United States, France, Germany, Australia, and Canada.

---

**Revalidated on 2026-03-12**

Five weeks after initial disclosure, CVE-2026-1731 has proven to be one of the most consequential vulnerabilities of early 2026. The exploitation lifecycle has been remarkable for its speed: from AI-driven discovery on January 31, to SaaS auto-patching on February 2, to advisory publication on February 6, to PoC release and first exploitation on February 10, to confirmed mass exploitation by February 12 -- a compressed timeline that highlights the shrinking window between disclosure and weaponization.

Several significant developments have occurred since initial publication. First, BeyondTrust revised its advisory on February 13 to confirm exploitation was actually detected as far back as January 31, making CVE-2026-1731 a confirmed zero-day that was exploited for at least one week before patches reached SaaS customers. Second, the threat landscape has broadened considerably: Arctic Wolf documented campaigns using SimpleHelp RMM for persistence with renamed binaries in ProgramData directories, PSExec and Impacket SMBv2 for lateral movement, and domain account creation with Enterprise Admin group escalation. Darktrace independently observed OAST domain callbacks (oast.fun), suspicious executable downloads, outbound beaconing to rare domains, and even cryptocurrency mining activity across customer environments. Third, CISA's March 5 update to the KEV entry formally flagged ransomware campaign association, confirming that exploitation has escalated from opportunistic scanning to hands-on-keyboard ransomware operations. Defense contractors and local government organizations were specifically cited as active targets by March 6.

The international response has also expanded, with the NHS England National CSOC (CC-4743), Canadian Centre for Cyber Security (AL26-003), and H-ISAC all issuing dedicated advisories. Intel 471 published a notable analysis framing CVE-2026-1731 as a landmark case for AI-driven vulnerability research, given that the Hacktron autonomous agent discovered it through variant analysis of CVE-2024-12356 -- the same thin-scc-wrapper vulnerability that Silk Typhoon exploited in the 2024 US Treasury breach. This AI-augmented discovery approach is expected to accelerate similar findings in the future.

With approximately 8,500 on-premises instances still potentially unpatched and exploitation confirmed across at least six countries and eight industry verticals, this threat remains critical. Organizations running self-hosted BeyondTrust RS or PRA must upgrade to RS 25.3.2 or PRA 25.1.1 immediately and conduct thorough compromise assessments. Scanner coverage is now available from Tenable (Nessus plugin 298510), Rapid7 (InsightVM/Nexpose), and community Nuclei templates.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1059.006 Python
- T1505.003 Web Shell
- T1136.001 Local Account
- T1136.002 Domain Account
- T1078.002 Domain Accounts
- T1070.004 File Deletion
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1003 OS Credential Dumping
- T1552.001 Credentials In Files
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1087.002 Domain Account
- T1021.002 SMB/Windows Admin Shares
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1071.004 DNS
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1486 Data Encrypted for Impact

## Sources

- [BeyondTrust Security Advisory BT26-02](https://www.beyondtrust.com/trust-center/security-advisories/bt26-02)
- [CISA KEV - CVE-2026-1731](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Unit 42: VShell and SparkRAT in Exploitation of CVE-2026-1731](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/)
- [Rapid7 ETR: Critical Unauthenticated RCE in BeyondTrust RS and PRA](https://www.rapid7.com/blog/post/etr-cve-2026-1731-critical-unauthenticated-remote-code-execution-rce-beyondtrust-remote-support-rs-privileged-remote-access-pra/)
- [GreyNoise: Reconnaissance for BeyondTrust RCE CVE-2026-1731](https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731)
- [NVD - CVE-2026-1731](https://nvd.nist.gov/vuln/detail/CVE-2026-1731)
- [GitHub PoC: CVE-2026-1731 by win3zz](https://github.com/win3zz/CVE-2026-1731)
- [BleepingComputer: BeyondTrust RCE Exploited in Ransomware Attacks](https://www.bleepingcomputer.com/news/security/beyondtrust-rce-vulnerability-exploited-in-ransomware-attacks/)
- [SecurityWeek: BeyondTrust Vulnerability Exploited in Ransomware Attacks](https://www.securityweek.com/beyondtrust-vulnerability-exploited-in-ransomware-attacks/)
- [H-ISAC TLP White Threat Bulletin: Active Exploitation of CVE-2026-1731](https://www.aha.org/h-isac-white-reports/2026-02-20-h-isac-tlp-white-threat-bulletin-active-exploitation-beyondtrust-cve-2026-1731)
- [Censys Advisory: BeyondTrust RS and PRA Pre-Auth RCE](https://censys.com/advisory/february-10-advisory-beyondtrust-remote-support-and-privileged-remote-access-flaw-allows-pre-authentication-rce-cve-2026-1731/)
- [Canadian Centre for Cyber Security Advisory AL26-003](https://www.cyber.gc.ca/en/alerts-advisories/al26-003-vulnerability-affecting-beyondtrust-cve-2026-1731)
- [Hacktron AI: CVE-2026-1731 Pre-Auth RCE Discovery](https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0193