BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731)

Key Points:

• CVE-2026-1731 is a critical remote code execution vulnerability in BeyondTrust's Remote Support and Privileged Remote Access tools, allowing unauthenticated attackers to execute OS commands.
• The vulnerability affects versions 25.3.1 and prior of Remote Support and 24.3.4 and prior of Privileged Remote Access, posing risks such as unauthorized access, data exfiltration, and service disruption.
• Organizations are urged to apply the patch or upgrade to fixed versions immediately to mitigate risk, as exploitation is straightforward.

Technical Details: CVE-2026-1731 results from improper neutralization of special elements in OS commands and can be exploited by sending specially crafted requests to vulnerable instances without authentication or user interaction.

MITRE ATT&CK Techniques:

• T1203 - Exploitation for Client Execution (Execution)
• T1078 - Valid Accounts (Defense Evasion)

IOCs Mentioned: None mentioned