Hacktron

Overview

Hacktron’s agents identified a critical pre-authentication remote code execution (RCE) vulnerability in BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). This has been assigned CVE-2026-1731 with a CVSS 9.9 critical score.

We found it through variant analysis, part of the autonomous scans we run across enterprise software, and disclosed it to BeyondTrust.

Impact

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user.

BeyondTrust Remote Support and Privileged Remote Access are widely deployed in enterprises for remote access and privileged session management.

Affected versions

Product Affected versions
Remote Support (RS) 25.3.1 and prior
Privileged Remote Access (PRA) 24.3.4 and prior

Fixed versions

Product Fixed versions
Remote Support (RS) Patch BT26-02-RS 25.3.2 and later
Privileged Remote Access (PRA) Patch BT26-02-PRA 25.1.1 and later

Exposure analysis

Our Shodan and Fofa search for BeyondTrust Remote Support deployments found:

  • About 11,000 instances are exposed to the internet, cloud and on-prem.

  • About 8,500 of those are on-prem deployments, which stay vulnerable until they are patched.

  • RS is commonly deployed in large enterprises, healthcare, financial services, government, and hospitality.

At this time, we are withholding technical details to allow affected parties sufficient time to apply patches. We strongly recommend addressing this vulnerability promptly, as exploitation is straightforward.

  • BeyondTrust patched all Remote Support SaaS customers by February 2, 2026.

  • Self-hosted customers of Remote Support and Privileged Remote Access should manually apply the patch if their instance is not subscribed to automatic updates.

Disclosure timeline

  1. Hacktron identifies the vulnerability through AI-enabled variant analysis

  2. Initial disclosure report submitted to BeyondTrust security team

  3. BeyondTrust confirms the vulnerability and begins patch development

  4. BeyondTrust patches cloud deployments and releases patch for on-prem

  5. BeyondTrust and Hacktron release advisory and CVE publication

Vendor response

BeyondTrust handled this disclosure exceptionally well. Its security team confirmed the vulnerability the day we reported it, deployed a patch to SaaS customers within 2 days, and coordinated the public disclosure timeline closely with us.

References

If you have questions about this advisory, email hello@hacktron.ai.