DaystoPatch

BeyondTrustExploited incident

BeyondTrust Remote Support and Privileged Remote Access pre-authentication remote code execution (BT26-02)

CVE-2026-1731Critical, CVSS 9.9In CISA's Known Exploited Vulnerabilities catalog since 13 Feb 2026

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    BeyondTrust security advisory BT26-02 (Wayback snapshot 2026-02-09)CuratedQuote verified

    BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability.

    First public signal: the advisory and CVE published 2026-02-06 ('Issue Date: 2026-02-06'). Earlier vendor notices (2026-02-03 customer-portal KB, 2026-02-04 email) were private.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2e7a6c6c2b3a24d9…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    CVE.org record CVE-2026-1731ClaimedQuote verified6 Feb 2026, 21:49 UTC

    BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c9ba9c906d0ec907…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet7 Feb 2026, 08:54 UTC

    The flaw, tracked as CVE-2026-1731 and classified under CWE-78 ( OS Command Injection ), enables attackers to execute arbitrary operating system commands without requiring authentication or user

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet9 Feb 2026, 14:00 UTC

    CVE-2026-1731: Pre-Auth RCE in BeyondTrust Remote Support & PRA # BeyondTrust # BeyondTrustSecureRemoteAccess # CVE_2026_1731 https://www. hacktron.ai/blog/cve-2026-1731 -be

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: greynoiseClaimedQuote verified12 Feb 2026

    Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far

    Earliest mention we hold (a vetted outlet).

    Source
    Research: greynoise research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1037703b81576029…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-1731)ClaimedQuote verified13 Feb 2026

    BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2026-02-13.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    BeyondTrust security advisory BT26-02, updated 2026-02-13 (Wayback snapshot 2026-03-30)CuratedQuote verified13 Feb 2026

    BeyondTrust is aware of and supporting a limited number of self-hosted customers in responding to active exploitation attempts of the previously disclosed critical vulnerability (CVE-2026-1731)

    Advisory shows 'Updated On: 2026-02-13'; its timeline says 'February 10, 2026 - Initial exploitation attempt observed.' The exploitation statement may have been added before 2026-02-13 (no snapshot between 02-09 and 02-15 captured readable content).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:73c9d0ad0154854a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    BleepingComputer (Bill Toulas, February 20, 2026)CuratedQuote not checked yet20 Feb 2026

    On February 13, BeyondTrust updated the bulletin to say that exploitation had been detected on January 31, making CVE-2026-1731 a zero-day vulnerability for at least a week.

    Retrospective reading of BeyondTrust's 2026-02-13 timeline; recorded for completeness (the advisory remains the earliest public signal).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    BeyondTrust security advisory BT26-02 (Wayback snapshot 2026-02-09)CuratedQuote verified

    Issue Date: 2026-02-06

    BeyondTrust's site blocks our fetcher, so Wayback snapshots are cited. NVD shows the CVE published 2026-02-06T22:16:11 UTC.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2e7a6c6c2b3a24d9…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    BeyondTrust security advisory BT26-02 (Wayback snapshot 2026-02-09)CuratedQuote verified

    A patch has been applied to all Remote Support SaaS and Privileged Remote Access SaaS customers as of Feb 2, 2026 that remediates this vulnerability.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2e7a6c6c2b3a24d9…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    BeyondTrust security advisory BT26-02, timeline (Wayback snapshot 2026-03-30)CuratedQuote verified

    February 2, 2026 - Patches (BT26-02-RS and BT26-02-PRA) issued and automatically deployed to all instances with BeyondTrust’s update service enabled. BeyondTrust SaaS instances fully patched.

    Patches cover RS v21.3-25.3.1 and PRA v22.1-24.x; RS older than 21.3 and PRA older than 22.1 must upgrade first. Fixed full releases: RS 25.3.2 and later, PRA 25.1.1 and later.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:73c9d0ad0154854a…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

BeyondTrust Remote Support pre-auth RCE flaw exploited; patched Feb 2, 2026

A pre-authentication command-injection flaw in BeyondTrust Remote Support and older Privileged Remote Access was seen in use on 31 January 2026, patched on 2 February, and widely exploited after a proof of concept appeared.

In plain words

BeyondTrust's remote support software, which IT staff use to connect to and control other computers, had a flaw that let an outsider run commands without a password. BeyondTrust saw unusual activity on 31 January 2026, fixed its cloud service and released patches on 2 February, and attacks on unpatched self-hosted servers began from 10 February. If we run this software ourselves, it must be patched, and any server that was exposed and unpatched after 9 February should be checked with BeyondTrust support.

What happened and who is affected

What happened

BeyondTrust published advisory BT26-02 for CVE-2026-1731 (CVSS 9.9) on 6 February 2026. The flaw lets an unauthenticated attacker run operating-system commands on Remote Support (RS) and older Privileged Remote Access (PRA). BeyondTrust's timeline says it detected anomalous activity on one appliance on 31 January and issued patches, deployed automatically to cloud and auto-updating instances, on 2 February. Exploitation attempts against unpatched self-hosted servers followed from 10 February. CISA later noted use in ransomware campaigns.

Who is affected

Self-hosted BeyondTrust Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier without patch BT26-02-RS or BT26-02-PRA. RS older than 21.3 and PRA older than 22.1 must upgrade first. BeyondTrust SaaS instances were patched by 2 February 2026.

CVE-2026-1731. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/beyondtrust-cve-2026-1731/

Affected products

  • BeyondTrust Remote Support (RS) 25.3.1 and prior
  • BeyondTrust Privileged Remote Access (PRA) 24.3.4 and prior
How we built this timeline

Patch shipped (2 Feb 2026) before public disclosure (6 Feb 2026), so First fix precedes world. AUDIT 2 (23 Oct 2026, T2): exploited before a fix changed false -> true.

BeyondTrust's 13 Feb 2026 timeline says 'January 31, 2026 - BeyondTrust Security Team detects anomalous activity on a single Remote Support appliance', which an external researcher then 'confirmed and validated'; BleepingComputer (20 Feb 2026) reads this as 'exploitation had been detected on January 31, making CVE-2026-1731 a zero-day vulnerability for at least a week', i.e. before the 2 Feb 2026 patch.

BeyondTrust separately dates the 'Initial exploitation attempt observed' to 10 Feb 2026 (after public disclosure); we take that as the start of post-disclosure attempts, not as contradicting the January 31 activity. KEV lists known ransomware use.

CVSS is BeyondTrust's CVSS 4.0 score (9.9).

Related

No related incidents.

BeyondTrust report card