- BeyondTrust Warns of Critical RCE CVE-2026-1731 Flaw in RS and PRA
- The vulnerability allows execution of unauthenticated operating system commands, risking compromise and data exfiltration.
- Patch released February 2, 2026; ~11,000 instances exposed, primarily on-premises deployments
US cybersecurity firm BeyondTrust has warned customers that its Remote Support (RS) product, as well as some older versions of Privileged Remote Access (PRA), are vulnerable to a remote code execution flaw that allows malicious actors to execute operating system commands in the context of the site user.
In a security advisory posted on the company’s page earlier this week, BeyondTrust said the bug, stemming from an operating system command injection weakness, is tracked as CVE-2026-1731 and received a severity score of 9.9/10 (critical).
This affects Remote Support 25.3.1 or earlier, and Privileged Remote Access 24.3.4 or earlier.
Fix the flaw
“Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service interruption,” BeyondTrust warned, adding that a patch was applied to all customers on February 2, 2026.
Those running self-hosted programs should apply the patch manually, in case their instances are not subscribed to automatic updates. BeyondTrust added that users on a Remote Support version prior to 21.3 or Privileged Remote Access prior to 22.1 will need to upgrade to a newer version, and PRA self-hosted customers will also be able to upgrade to 25.1.1 or later.
BeyondTrust is a leading provider of identity security services, with more than 20,000 customers in more than 100 countries around the world.
Harsh Jaiswal and the Hacktron AI team, who are credited with discovering the flaw, said about 11,000 instances are exposed to the internet, including cloud and on-premises deployments. “Approximately 8,500 of these are on-premises deployments that remain potentially vulnerable if patches are not applied,” Hacktron said.
Commenting on the findings, BeyondTrust told BleepingComputer that it found no evidence that the flaw had been misused in the wild.
Via BeepComputer
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
