Particle.news

BeyondTrust Patches Critical Pre-Auth RCE in Remote Access Tools

Researchers warn thousands of internet-facing on-premises instances need immediate updates.

Overview

  • The flaw, tracked as CVE-2026-1731 with a CVSS score of 9.9, is an OS command injection that enables unauthenticated remote code execution.
  • Affected builds include Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier, with fixes in RS 25.3.2+ and PRA 25.1.1+.
  • BeyondTrust applied protections to all Remote Support and Privileged Remote Access cloud environments on February 2, 2026.
  • Hacktron AI estimates roughly 11,000 instances are exposed online, including about 8,500 on-prem deployments that remain at risk until patched.
  • There are no confirmed in-the-wild attacks, and researchers are withholding technical details to reduce abuse risk after previously exploited BeyondTrust zero-days.