CVE-2026-1731: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

BeyondTrust Remote Support and Privileged Remote Access contain an OS command injection flaw that lets an unauthenticated remote attacker run operating system commands as the site user. No user interaction is required. Successful exploitation can result in full system compromise, unauthorized access, data exfiltration, or service disruption. The vulnerability is tracked as CVE-2026-1731 and is known to have been used in ransomware campaigns.

How it works

The weakness is categorized as CWE-78, improper neutralization of special elements used in an OS command. An attacker supplies crafted input that the application passes directly to the underlying operating system shell. Because the input is not sanitized, arbitrary commands execute in the context of the site user. The attack requires no authentication and can be performed over the network.

Am I affected? How to find it in your systems

Inventory all deployments of BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). These products are typically installed as on-premises appliances or cloud-hosted services that provide remote access and privileged session management. Confirm the exact versions and configurations in use against the vendor advisory, as only specific releases are affected. Review network exposure of the management interfaces and any integrations that accept unauthenticated input. Monitor logs for unexpected process spawns or command execution originating from the application user account; such activity is a potential indicator of exploitation.

How to remediate

Apply the vendor-supplied update or mitigation instructions referenced in the official advisory. Where the products are delivered as cloud services, follow applicable BOD 22-01 guidance. If no effective mitigation is available, discontinue use of the affected product. After patching, verify that the vulnerable code paths have been removed by re-testing the inventory.

If you can't patch immediately

Restrict network access to the management interfaces through segmentation and allow-listing so that only trusted sources can reach the products. Consider virtual patching or web application firewall rules that block command-injection patterns targeting the affected endpoints. Disable or tightly control any features that accept unauthenticated input until the update can be applied. Increase monitoring of process creation and outbound connections from the site user context to detect attempted exploitation.

If your data may have been exposed

Actively exploited vulnerabilities of this type have led to breaches and ransomware deployment. Review authentication logs, session recordings, and data-access events for the affected systems. Organizations can run a free exposure scan of their email domains to check for presence in known breach data.