BeyondTrust Remote Support - RCE (CVE-2026-1731)
Description
BeyondTrust Remote Support and Privileged Remote Access products are vulnerable to pre-authentication OS command injection via the WebSocket endpoint, allowing unauthenticated attackers to execute arbitrary commands on the server.
psychologyCrowdSec Analysis
CVE-2026-1731 is a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access. Attackers can extract the company identifier and inject OS commands through binary WebSocket payloads.
CrowdSec has been tracking this vulnerability and its exploits since 12th of March 2026.
CrowdSec network data shows that most actors exploiting CVE-2026-1731 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-1731 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-1731 is currently experiencing high visibility and active exploitation across the internet.
Attackers first request /get_mech_list to extract the company identifier, then upgrade to a WebSocket connection at /nw with the X-Ns-Company header, and inject OS commands through crafted binary WebSocket frames.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-01-15 |
| CISA KEV | 2026-02-13 |
| CISA Remediation Deadline | 2026-02-16 |
| Rule Released | 2026-03-12 |
| CrowdSec First Seen | 2026-03-16 |