CVE-2026-1731: BeyondTrust RS and PRA Pre-Auth RCE

Source-specific exposure conditions

• BeyondTrust Remote Support version 25.3.1 or earlier is affected.
• BeyondTrust Privileged Remote Access version 24.3.4 or earlier is affected; NVD CPE data separately identifies versions before 25.1, so confirm the applicable product/version guidance with BeyondTrust.
• Risk is highest for internet-facing, self-hosted appliances that had not received the BT26-02 patch before February 9, 2026.
• Remote Support and Privileged Remote Access SaaS instances were reported by BeyondTrust as patched automatically; confirm status with the provider if assurance is required.

Source-specific remediation

• Immediately prioritize remediation because the vulnerability is actively exploited and listed in CISA KEV.
• For self-hosted Remote Support, apply patch BT26-02-RS through the BeyondTrust appliance interface, or upgrade to Remote Support 25.3.2 or later.
• For self-hosted Privileged Remote Access, apply patch BT26-02-PRA through the BeyondTrust appliance interface, or upgrade to a BeyondTrust-supported fixed release. BeyondTrust identifies 25.1 and later as fixed and separately recommends 25.1.1 or later; use the vendor's current guidance when selecting the target release.
• If automatic updates are enabled, confirm that the BT26-02 update was successfully applied rather than relying solely on the update setting.
• For internet-exposed, self-hosted instances that remained unpatched as of February 9, 2026, apply the update immediately and open a BeyondTrust Severity 1 support ticket citing BT26-02, consistent with the vendor advisory.
• Until remediation is confirmed, reduce unnecessary internet exposure using approved access-control or network-segmentation measures without treating those measures as a substitute for patching.

Source-specific verification

• Review the BeyondTrust appliance interface and confirm that the applicable BT26-02 patch is installed or that the running product version is at or above the vendor-stated fixed release.
• Verify Remote Support is running version 25.3.2 or later, or has BT26-02-RS applied.
• Verify Privileged Remote Access is running the vendor-approved fixed release, with BeyondTrust's advisory identifying 25.1 or later and its mitigation text recommending 25.1.1 or later, or confirm BT26-02-PRA is applied.
• For SaaS deployments, obtain confirmation from BeyondTrust or the service administration portal that the February 2, 2026 remediation was applied.
• For internet-facing self-hosted systems, review vendor-recommended incident-response guidance and investigate signs of compromise; do not perform unauthenticated exploit testing against production systems.

Uncertainty and evidence gaps

• BeyondTrust's advisory contains a minor Privileged Remote Access version discrepancy: the fixed-version table states 25.1 and later, while the mitigation text recommends 25.1.1 or newer. Treat 25.1.1 or a later vendor-approved release as the conservative target unless BeyondTrust confirms otherwise.
• The supplied source record's generic ecosystem classification does not identify deployment type, internet exposure, update configuration, or installed versions; those facts require asset-level validation.
• No authoritative source reviewed here provides a detailed compromise-indicator set or a non-invasive exploit-specific test procedure.

Claim-to-source evidence

• Affected Product: BeyondTrust Remote Support and certain older Privileged Remote Access versions are affected by CVE-2026-1731. Evidence
• Affected Version: BeyondTrust identifies Remote Support 25.3.1 and prior, and Privileged Remote Access 24.3.4 and prior, as affected. Evidence
• Exposure: The vulnerability is pre-authentication and may allow an unauthenticated remote attacker to execute operating-system commands; BeyondTrust reports observed exploitation against internet-facing, self-hosted environments that were unpatched before February 9, 2026. Evidence
• Exposure: CVE-2026-1731 is listed in CISA's Known Exploited Vulnerabilities catalog with a required action to apply vendor mitigations or discontinue use if mitigations are unavailable. Evidence
• Fixed Version: BeyondTrust lists Remote Support 25.3.2 and later as fixed, and Privileged Remote Access 25.1 and later as fixed; its mitigation text recommends Privileged Remote Access 25.1.1 or newer. Evidence
• Remediation: Self-hosted customers should apply BT26-02-RS or BT26-02-PRA through the appliance interface when automatic updates are not enabled; SaaS instances were reported as patched automatically. Evidence
• Verification: The advisory identifies the appliance interface as the location for applying the patch and provides fixed product versions, supporting verification through patch status or installed-version review rather than exploit testing. Evidence

Synthesis sources

• www.beyondtrust.com
• nvd.nist.gov

Generation provenance

Model

gpt-5.6-luna

Generated

2026-07-14T23:39:17Z

Prompt version

2026-07-14.2

Specificity

specific

Source fingerprint

25bfd5cfaa8fc2c656d7dce9c2909549dd63aed54040c05a3bdc6db0a84f6273

Recorded gaps

• generic_ecosystem