Search: CVE-2026-1731

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability (CVE-2026-1731). An unauthenticated remote attacker can send specially crafted requests to execute operating system commands with site user privileges. This vulnerability has a very high CVSS score of 9.9 and is known to be exploited in the wild, including use in ransomware campaigns.

CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support versions 26.2.3 and earlier. It enables unauthenticated remote attackers to perform arbitrary file operations without user interaction. Exploitation in the wild has been confirmed, involving deployment of web shells and tunneling tools, root privilege escalation, credential vault extraction attempts, persistence mechanisms, and log deletion. The threat actor ARMORY CASTLE, linked to PRC-nexus espionage, is attributed to these attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities list. Emergency patching and thorough compromise investigations are required, as patching alone does not remove attacker persistence.