Background exploitation KEV catalog Ransomware No authentication

CVE-2026-1731

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote…

CheckOps priority index

9.8/10 Patch within 24 h

Severity9.9

Probability9.4

Exploitation5/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 93.9% +0.8 pts in 7 days

CVSS 4.0 9.9 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/

Exploited for 263 days 13 Feb 2026

CISA due date 16 Feb 2026 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 5 / 5

KEV catalog (CISA)13 Feb 2026
Exploited in EUVD (ENISA)13 Feb 2026
Used by ransomwareyes
EPSS above 10 %93.9%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Affected products

Remote Support(RS) & Privileged Remote Access(PRA)Remote Support (RS) and Privileged Remote Access (PRA)

Affected versions

0 ≤RS 25.3.1
0 ≤PRA 24.3.4

Weaknesses (CWE)

CWE-78

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

06 Feb 2026
Published
13 Feb 2026
Exploitation reported (ENISA)
13 Feb 2026
Added to the KEV catalog
16 Feb 2026
CISA remediation due date
01 Nov 2026
EPSS peak: 93.9%

References

Other exploited vulnerabilities from the same vendor

CVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
6.7 · Rising fast
CVE-2024-12686BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability
5.4 · Background exploitation
CVE-2024-12356BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability
8.9 · Background exploitation