🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2026-1731

9.9

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

remote support(rs) & privileged remote access(pra)

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalNetwork Vulnerabilities~10 seconds

BeyondTrust Remote Support - Unauthenticated WebSocket RCE

BeyondTrust Remote Support is vulnerable to unauthenticated remote code execution via the WebSocket endpoint /nw. An attacker can extract the company identifier from the /get_mech_list endpoint and use it to connect to the WebSocket service, then inject OS commands through the binary WebSocket payload that are executed on the server. References: https://attackerkb.com/topics/jNMBccstay/cve-2026-1731/rapid7-analysis https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 Remediation: Apply the latest security patches provided by BeyondTrust for Remote Support and Privileged Remote Access products.

Used 18 times · 9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: remote support(rs) & privileged remote access(pra)

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →