BeyondTrust Remote Support and PRA Critical RCE Under

Executive Summary

A critical pre-authentication remote code execution (RCE) vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) is under active exploitation by multiple threat actors. The vulnerability, tracked as CVE-2026-1731 (CVSSv4 9.9), allows unauthenticated remote attackers to execute arbitrary OS commands via a trivially simple crafted WebSocket message.

CVSS Score: 9.9 (Critical)

CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026. Palo Alto's Unit 42 has observed post-exploitation deployment of VShell and SparkRAT backdoors.

Vulnerability Overview

Root Cause

CVE-2026-1731 is a pre-authentication command injection vulnerability triggered through specially crafted client requests. The exploit is described by researchers as "trivially simple" — essentially a WebSocket message with a crafted version string that achieves full remote code execution.

Affected Versions and Patches

SaaS customers: Patches were automatically deployed on February 2, 2026.

Self-hosted customers: Must apply updates manually. Internet-exposed instances unpatched as of February 9 are at critical risk.

Exploitation Timeline

Attack Chain

1. Attacker identifies internet-exposed BeyondTrust RS/PRA instance
2. Sends crafted WebSocket message with malicious version string
3. Server processes the message without authentication
4. OS command injection achieves arbitrary code execution
5. Attacker deploys VShell or SparkRAT for persistent access
6. Lateral movement into internal network via the remote access platform

Post-Exploitation Malware

Why This Is Especially Dangerous

BeyondTrust's Position in Networks

BeyondTrust Remote Support and PRA are deployed specifically to provide privileged remote access to systems. Compromising these appliances gives attackers:

• Legitimate remote access infrastructure to pivot into internal networks
• Credential access — Remote support sessions may contain stored credentials
• Session hijacking — Active support sessions can be intercepted or replicated
• Trust exploitation — Traffic from BeyondTrust appliances is typically trusted and may bypass network monitoring

Pre-Auth + Trivial Exploit = Mass Exploitation

The combination of:

1. No authentication required
2. Trivially simple exploit (single WebSocket message)
3. Internet-exposed by design (it's a remote access product)
4. Public PoCs available

...creates the conditions for mass exploitation, which is exactly what has been observed since February 10.

Immediate Remediation

Patch Now

1. Self-hosted customers: Apply updates immediately
2. SaaS customers: Verify automatic patch was applied (check version number)
3. Verify no compromise: Audit appliance logs from January 31 onward

If Immediate Patching Is Not Possible

1. Remove BeyondTrust appliances from internet exposure immediately
2. Place behind VPN or zero-trust access controls
3. Monitor for WebSocket anomalies — Unusual version strings in connection handshakes
4. Hunt for VShell and SparkRAT IOCs across the environment
5. Engage incident response if any indicators of compromise are detected

Detection

Network Indicators

CISA KEV Deadline

CISA's addition to the KEV catalog on February 13 requires federal agencies to patch by the published deadline. However, with the DHS shutdown furloughing 62% of CISA, enforcement and verification are degraded.

Key Takeaways

1. CVSSv4 9.9 — Pre-auth RCE via trivial WebSocket exploit
2. Active exploitation confirmed by multiple threat actors deploying VShell and SparkRAT
3. Patch immediately — Self-hosted instances unpatched since Feb 9 are at critical risk
4. BeyondTrust's position in networks makes this especially dangerous for lateral movement
5. CISA KEV listed — Federal agencies have mandatory patching deadlines

References

• BeyondTrust Security Advisory BT26-02
• Rapid7 — CVE-2026-1731: Critical Unauthenticated RCE in BeyondTrust
• Palo Alto Unit 42 — VShell and SparkRAT in BeyondTrust Exploitation
• Help Net Security — Hackers Probe, Exploit Newly Patched BeyondTrust RCE Flaw
• CISA — Known Exploited Vulnerabilities Catalog

Related Reading

• BeyondTrust Remote Support Pre-Authentication RCE Under
• BeyondTrust Zero-Day Allows Unauthenticated Command
• Cisco Unified Communications Zero-Day Exploited for