BeyondTrust Zero-Day Allows Unauthenticated Command

Executive Summary

A critical zero-day vulnerability has been disclosed in BeyondTrust's Remote Support and Privileged Remote Access platforms that allows attackers to execute commands without authentication. Given BeyondTrust's role in managing privileged access across enterprise networks, successful exploitation could compromise entire organizational infrastructures.

CVSS Score: 9.8 (Critical)

BeyondTrust deployed automatic patches to SaaS customers on February 2, 2026. Self-hosted deployments require immediate manual patching.

Vulnerability Overview

Root Cause

CVE-2026-1731 is an unauthenticated command execution vulnerability in BeyondTrust's Remote Support and Privileged Remote Access products. The flaw was discovered through variant analysis by security researchers Harsh Jaiswal and Hacktron AI, who identified a bypass in the authentication layer of the management API.

Why BeyondTrust Compromise Is Critical

BeyondTrust products are specifically designed to manage the most sensitive access in an organization:

Technical Details

Affected Versions

Attack Vector

1. Attacker sends crafted request to BeyondTrust management API
2. Authentication bypass exploits flaw in session validation
3. Unauthenticated command execution achieved on the appliance
4. Attacker gains access to privileged credential vault
5. Lateral movement using stored credentials for managed endpoints
6. Full infrastructure compromise via privileged session hijacking

Context: Previous BeyondTrust Incidents

This is not the first critical vulnerability in BeyondTrust products. In December 2024, the U.S. Treasury Department was breached through a compromised BeyondTrust API key (CVE-2024-12356), demonstrating the real-world impact of BeyondTrust compromises at the highest levels of government.

Immediate Remediation

SaaS Customers

BeyondTrust automatically deployed patches to all SaaS instances on February 2, 2026. No action required, but verify your instance is on the latest version.

Self-Hosted Deployments

Apply the relevant patch immediately:

Older versions that are no longer on a supported release require an upgrade before the patch can be applied.

If Immediate Patching Is Not Possible

1. Restrict management API access to trusted IP ranges only
2. Disable external-facing management interfaces if not required
3. Monitor for anomalous API calls to the management endpoint
4. Enable multi-factor authentication on all administrative accounts
5. Review and rotate all credentials stored in the privileged vault

Detection and Investigation

Log Review

Check BeyondTrust appliance logs for indicators of exploitation:

• Unexpected API calls to the management interface from external IPs
• New administrative accounts created without authorization
• Credential vault access outside of normal business hours
• Session hijacking attempts or unauthorized remote support sessions
• Configuration changes to security policies or access controls

Network Indicators

Post-Remediation Steps

1. Rotate all credentials stored in the BeyondTrust vault
2. Review session recordings for the past 30 days for unauthorized access
3. Audit administrative accounts for unauthorized additions or changes
4. Check managed endpoints for signs of lateral movement
5. Review Active Directory for unauthorized changes if BeyondTrust is AD-integrated
6. Enable enhanced logging and forward to SIEM for ongoing monitoring
7. Conduct threat hunt across infrastructure accessible via BeyondTrust

Enterprise Impact Assessment

Organizations using BeyondTrust for privileged access management should treat this as a Severity 1 incident and immediately assess:

• Whether the management API was exposed to the internet
• Whether any stored credentials were accessed
• Whether active support sessions were compromised
• Whether the vulnerability was exploited before patches were applied

Given BeyondTrust's position as a privileged access management platform, a compromise of this system is functionally equivalent to a compromise of every system it manages.

References

• BeyondTrust Security Advisory
• CISA Known Exploited Vulnerabilities Catalog
• NIST NVD — CVE-2026-1731

Related Reading

• BeyondTrust Remote Support and PRA Critical RCE Under
• BeyondTrust Remote Support Pre-Authentication RCE Under
• Cisco Unified Communications Zero-Day Exploited for