CVE-2026-1731BeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
What broke
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a pre-authentication OS command injection (CWE-78). NVD, which published the record on February 6, 2026, says specially crafted requests let an unauthenticated remote attacker run operating system commands as the site user. NVD scores it CVSS 3.1 9.8; BeyondTrust's CVSS 4.0 score is 9.9. BeyondTrust tracks it as advisory BT26-02.
GreyNoise reported on February 12, 2026 that the flaw is a variant of CVE-2024-12356. It uses the same WebSocket endpoint through a different code path. According to GreyNoise, BeyondTrust patched cloud customers automatically on February 2. Self-hosted customers have to move to RS 25.3.2 or later, or PRA 25.1.1 or later. A proof-of-concept appeared on GitHub on February 10, and GreyNoise saw reconnaissance surge from February 11. CISA added it to KEV on February 13, 2026 and marks it as used in ransomware campaigns. Microsoft lists it among the vulnerabilities exploited by Storm-1175, the group that deploys Medusa ransomware.
Why it matters
Remote Support and PRA are where an organization keeps privileged access to everything else: stored credentials, jump sessions and agents on servers and workstations. Command execution on the appliance needs no login, so the attacker starts with whatever the appliance can reach. The same endpoint has now produced two pre-auth flaws in 14 months, and a third BeyondTrust bypass, CVE-2026-102764, followed in October 2026. Treat the appliance as tier-zero privileged access, not as IT tooling.
What to do
- Upgrade self-hosted RS to 25.3.2 or later and PRA to 25.1.1 or later. Confirm cloud instances show the patched build.
- Keep the appliance's web interface off the open internet where you can, or restrict it to known source addresses.
- Check every internet-facing BeyondTrust appliance for signs of compromise, as CISA's KEV entry directs.
After you patch
- Rotate credentials stored in the appliance vault and any API keys it issued.
- Review session and admin logs from early February 2026 onward for sessions or accounts you cannot attribute.
- Look for new admin users, PsExec activity and Cloudflare tunnel services on hosts the appliance manages, all of which Microsoft reports in Storm-1175 intrusions.
Sources
Related identity CVEs
Related on Start with Identity
- CVESimpleHelp technicians can promote themselves to server admin
Missing backend authorization checks in SimpleHelp 5.5.7 and earlier let a low-privilege technician make API keys with admin rights and take over the remote sup
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M
- GlossaryPrivileged Remote Access (PRA)
Privileged remote access (PRA) is the brokering of administrative sessions to servers, network devices, databases and OT systems for remote employees, vendors a
- PodcastDelinea
Delinea's ethical hacker Joseph Carson on privileged access, ransomware, and security culture. 126 episodes from 2020 to February 2025.