# CVE-2026-1731: BeyondTrust Remote Support - RCE

> Live exploitation tracking for CVE-2026-1731 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-1731

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** BeyondTrust Remote Support, BeyondTrust Privileged Remote Access
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** enterprise_software

## Description

BeyondTrust Remote Support and Privileged Remote Access products are vulnerable to pre-authentication OS command injection via the WebSocket endpoint, allowing unauthenticated attackers to execute arbitrary commands on the server.

## CrowdSec analysis

[CVE-2026-1731](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-1731) is a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access. Attackers can extract the company identifier and inject OS commands through binary WebSocket payloads.

CrowdSec has been tracking this vulnerability and its exploits since 12th of March 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-1731 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-1731 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-1731 is currently experiencing high visibility and active exploitation across the internet.

Attackers first request `/get_mech_list` to extract the company identifier, then upgrade to a WebSocket connection at `/nw` with the `X-Ns-Company` header, and inject OS commands through crafted binary WebSocket frames.

## Timeline

- 2026-01-15: CVE Published. CVE-2026-1731 is published to NVD.
- 2026-02-13: CISA KEV. CVE-2026-1731 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-02-16: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-03-12: Rule Released. CrowdSec releases a rule to detect CVE-2026-1731 exploitation attempts against the CrowdSec Network.
- 2026-03-16: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-1731 for the first time.

## References

- https://www.beyondtrust.com/trust-center/security-advisories/bt26-02
- https://attackerkb.com/topics/jNMBccstay/cve-2026-1731/rapid7-analysis
- https://nvd.nist.gov/vuln/detail/CVE-2026-1731
- https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-1731.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-1731) follows observed exploitation activity for CVE-2026-1731. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.