BeyondTrust Remote Access Products 0-Day RCE
BeyondTrust has issued an urgent security advisory regarding a critical zero-day vulnerability affecting its popular remote access solutions.
The flaw, tracked as CVE-2026-1731, carries a near-maximum severity score of 9.9 out of 10 on the CVSSv4 scale.
It poses a significant risk to organizations using self-hosted versions of BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA).
The vulnerability is classified as a “pre-authentication remote code execution” (RCE) issue. This is considered one of the most dangerous types of security flaws.
In simple terms, “pre-authentication” means an attacker does not need a username, password, or any valid credentials to exploit the system.
“Remote code execution” means the attacker can run commands on the victim’s server from anywhere on the internet.
According to the advisory, the flaw stems from an OS Command Injection issue (CWE-78).
By sending a specially crafted request to a vulnerable appliance, an unauthenticated attacker can execute operating system commands with the privileges of the “site user.”
Successful exploitation could lead to total system compromise, unauthorized data theft, or service disruption without any interaction from a legitimate user.
The vulnerability affects the following products:
The urgency of the response depends on how your organization deploys BeyondTrust software:
1. Cloud/SaaS Customers: You are already protected. BeyondTrust applied a patch to all SaaS instances on February 2, 2026. No further action is required for cloud-hosted environments.
2. Self-Hosted/On-Premise Customers: You are at risk and must take action immediately. Administrators should log in to their appliance interface and check for updates.
This vulnerability was responsibly disclosed by Harsh Jaiswal and the Hacktron AI team.
The discovery is notable because it utilized a novel approach involving AI-enabled variant analysis, highlighting the growing role of artificial intelligence in both defending and auditing cybersecurity infrastructure.
Security teams are advised to review their logs for suspicious activity and prioritize patching immediately, given the critical nature of the flaw and the potential for active exploitation.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…