VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 09:21 UTC
← Dashboard

CVE-2026-1731

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating syste…

Read full description
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
CVSS 9.9 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
1.6/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.9: +1.49
  • Fresh EPSS: 93.85%: +0.47

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 29 documents and public datasets.

Hype components

Headline sample (25%)
50/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
0/100
HYPE TOTAL16/100

Sources and documents

Rapid7 Cybersecurity Blog
Press · 19 Oct 2026, 14:34 · CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Threat Intelligence
Press · 30 Sep 2026, 14:00 · Vulnerability Discovery and Exploitation Trends in the AI Era
The Hacker News
Press · 07 Jul 2026, 07:00 · BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA - The Hacker News
Dark Reading
Press · 21 Apr 2026, 07:00 · Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk - Dark Reading
Recorded Future
Press · 12 Mar 2026, 07:00 · February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January - Recorded Future
See all 29 source documents
Security Affairs
Press · 23 Feb 2026, 08:00 · CVE-2026-1731 fuels ongoing attacks on BeyondTrust remote access products - Security Affairs
The Hacker News
Press · 20 Feb 2026, 08:00 · BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration - The Hacker News
BleepingComputer
Press · 20 Feb 2026, 08:00 · CISA: BeyondTrust RCE flaw now exploited in ransomware attacks - BleepingComputer
SecurityWeek
Press · 20 Feb 2026, 08:00 · BeyondTrust Vulnerability Exploited in Ransomware Attacks - SecurityWeek
Unit 42
Press · 19 Feb 2026, 08:00 · VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) - Unit 42
CyberSecurityNews
Press · 16 Feb 2026, 08:00 · Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain Control - CyberSecurityNews
BleepingComputer
Press · 16 Feb 2026, 08:00 · CISA gives feds 3 days to patch actively exploited BeyondTrust flaw - BleepingComputer
Cyber Press
Press · 13 Feb 2026, 08:00 · Patch Immediately: BeyondTrust Remote Code Execution Flaw Exploited in the Wild - Cyber Press
SecurityWeek
Press · 13 Feb 2026, 08:00 · BeyondTrust Vulnerability Targeted by Hackers Within 24 Hours of PoC Release - SecurityWeek
Help Net Security
Press · 13 Feb 2026, 08:00 · Hackers probe, exploit newly patched BeyondTrust RCE flaw (CVE-2026-1731) - Help Net Security
The Hacker News
Press · 13 Feb 2026, 08:00 · Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability - The Hacker News
Arctic Wolf
Press · 13 Feb 2026, 08:00 · Update: Arctic Wolf Observes Threat Campaign Targeting BeyondTrust Remote Support Following CVE-2026-1731 PoC Availability - Arctic Wolf
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 12 Feb 2026, 08:00 · BeyondTrust Products Remote Code Execution Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
GreyNoise
Press · 12 Feb 2026, 08:00 · Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far - GreyNoise
BleepingComputer
Press · 12 Feb 2026, 08:00 · Critical BeyondTrust RCE flaw now exploited in attacks, patch now - BleepingComputer
SecurityWeek
Press · 10 Feb 2026, 08:00 · BeyondTrust Patches Critical RCE Vulnerability - SecurityWeek
Help Net Security
Press · 09 Feb 2026, 08:00 · BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731) - Help Net Security
The Hacker News
Press · 09 Feb 2026, 08:00 · BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA - The Hacker News
Rapid7
Press · 09 Feb 2026, 08:00 · CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) - Rapid7
BleepingComputer
Press · 09 Feb 2026, 08:00 · BeyondTrust warns of critical RCE flaw in remote support software - BleepingComputer
Security Affairs
Press · 09 Feb 2026, 08:00 · BeyondTrust fixes critical pre-auth bug allowing remote code execution - Security Affairs
CCB Belgium
Press · 09 Feb 2026, 08:00 · Warning: Remote Code Execution in BeyondTrust Remote Support and Privileged Remote Access, Patch Immediately! - CCB Belgium
Arctic Wolf
Press · 09 Feb 2026, 08:00 · Recommendation for CVE-2026-1731 - Arctic Wolf
CyberSecurityNews
Press · 07 Feb 2026, 08:00 · BeyondTrust Remote Access Products 0-Day Vulnerability Allows Remote Code Execution - CyberSecurityNews

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 1.6 · reality 9.0 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
jakubie07/CVE-2026-173160Rust02 May 2026, 19:52
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.9; EPSS 93.9%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:58.968821+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
06 Feb 2026, 21:49
First press mention
07 Feb 2026, 08:00
Added to the CISA KEV catalog
13 Feb 2026, 00:00
Latest press mention
19 Oct 2026, 14:34
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
1 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar