CVE-2026-1731 is an OS command injection vulnerability (CWE-78) in BeyondTrust Remote Support and certain older versions of Privileged Remote Access. The flaw allows unauthenticated remote attackers to execute arbitrary operating system commands due to improper neutralization of special elements in OS commands. This vulnerability is exploitable without user interaction and affects only on-premises deployments. The CVSS 4.0 base score is 9.9, reflecting critical impact with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official vendor advisory or patch information is currently available, and no exploitation in the wild has been reported.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on affected systems, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected systems. It is limited to on-premises deployments of BeyondTrust Remote Support and certain older versions of Privileged Remote Access. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor BeyondTrust communications for updates and consider implementing network-level protections to restrict access to affected services. No vendor advisory or official mitigation instructions are currently available.