# BeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356

Source: https://startwithidentity.com/cves/cve-2026-1731/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

[BeyondTrust](https://startwithidentity.com/vendors/pam/beyondtrust/) Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a pre-authentication OS command injection (CWE-78). NVD, which published the record on February 6, 2026, says specially crafted requests let an unauthenticated remote attacker run operating system commands as the site user. NVD scores it CVSS 3.1 9.8; BeyondTrust's CVSS 4.0 score is 9.9. BeyondTrust tracks it as advisory BT26-02.

GreyNoise reported on February 12, 2026 that the flaw is a variant of [CVE-2024-12356](https://startwithidentity.com/cves/cve-2024-12356/). It uses the same WebSocket endpoint through a different code path. According to GreyNoise, BeyondTrust patched cloud customers automatically on February 2. Self-hosted customers have to move to RS 25.3.2 or later, or PRA 25.1.1 or later. A proof-of-concept appeared on GitHub on February 10, and GreyNoise saw reconnaissance surge from February 11. CISA added it to KEV on February 13, 2026 and marks it as used in ransomware campaigns. Microsoft lists it among the vulnerabilities exploited by Storm-1175, the group that deploys Medusa ransomware.

## Why it matters

Remote Support and PRA are where an organization keeps privileged access to everything else: stored credentials, jump sessions and agents on servers and workstations. Command execution on the appliance needs no login, so the attacker starts with whatever the appliance can reach. The same endpoint has now produced two pre-auth flaws in 14 months, and a third BeyondTrust bypass, [CVE-2026-102764](https://startwithidentity.com/cves/cve-2026-102764/), followed in October 2026. Treat the appliance as [tier-zero privileged access](https://startwithidentity.com/guides/fundamentals/what-is-pam/), not as IT tooling.

## What to do

- Upgrade self-hosted RS to 25.3.2 or later and PRA to 25.1.1 or later. Confirm cloud instances show the patched build.
- Keep the appliance's web interface off the open internet where you can, or restrict it to known source addresses.
- Check every internet-facing BeyondTrust appliance for signs of compromise, as CISA's KEV entry directs.

## After you patch

- Rotate credentials stored in the appliance vault and any API keys it issued.
- Review session and admin logs from early February 2026 onward for sessions or accounts you cannot attribute.
- Look for new admin users, PsExec activity and Cloudflare tunnel services on hosts the appliance manages, all of which Microsoft reports in Storm-1175 intrusions.

## Sources

- [NVD: CVE-2026-1731](https://nvd.nist.gov/vuln/detail/cve-2026-1731)
- [BeyondTrust security advisory BT26-02](https://www.beyondtrust.com/trust-center/security-advisories/bt26-02)
- [GreyNoise: Reconnaissance targeting BeyondTrust RCE CVE-2026-1731 (February 12, 2026)](https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731)
- [Microsoft Threat Intelligence: Storm-1175 and Medusa ransomware (April 6, 2026)](https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/)
- [CISA Known Exploited Vulnerabilities catalog, added February 13, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731)