Overview
- The flaw, tracked as CVE-2026-1731 with a CVSS score of 9.9, is an OS command injection that enables unauthenticated remote code execution.
- Affected builds include Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier, with fixes in RS 25.3.2+ and PRA 25.1.1+.
- BeyondTrust applied protections to all Remote Support and Privileged Remote Access cloud environments on February 2, 2026.
- Hacktron AI estimates roughly 11,000 instances are exposed online, including about 8,500 on-prem deployments that remain at risk until patched.
- There are no confirmed in-the-wild attacks, and researchers are withholding technical details to reduce abuse risk after previously exploited BeyondTrust zero-days.