A critical vulnerability, identified as CVE-2026-1731, has been discovered in BeyondTrust’s Remote Support and Privileged Remote Access products. This remote code execution (RCE) vulnerability has a CVSS score of 9.9, underscoring its severity. It allows unauthenticated attackers to execute OS commands remotely, posing significant risks to affected systems.
The vulnerability is traced to the thin-scc-wrapper component, exploited via WebSocket connections due to unsanitized bash arithmetic evaluation of the remoteVersion parameter. This flaw enables command injection without requiring user credentials, leading to potential system compromise, data exfiltration, and service disruptions.
BeyondTrust quickly responded by releasing patches for both Remote Support and Privileged Remote Access products. While cloud customers were automatically patched on February 2, 2026, those with self-hosted deployments are required to apply updates manually. It is estimated that approximately 8,500 on-premises instances need patching.
Despite no active exploitation initially apparent, research groups such as Arctic Wolf, Unit 42, and CISA have observed active exploitation campaigns. These campaigns have targeted financial, legal, healthcare, and tech sectors across several countries, including the US, France, Germany, Australia, and Canada. Attackers have been observed deploying remote monitoring and management tools like SimpleHelp, creating domain admin accounts, conducting lateral network movements, and deploying backdoors like SparkRAT and VShell.
The situation is complicated by the presence of a public proof-of-concept exploit that has spurred further illicit activities. Many Bomgar B-series appliances affected by this vulnerability have reached end of life, presenting additional challenges for applying necessary patches.
Security organizations advise self-hosted customers to prioritize this patch and employ threat hunting queries to detect any suspicious activity stemming from this vulnerability. Given the critical nature and the history of state-sponsored attacks against BeyondTrust products, prompt action is crucial to safeguard networks from potential exploitation.

Collections

CVE-2026-1731 is a critical RCE vulnerability (CVSS 9.9) in BeyondTrust's Remote Support and Privileged Remote Access products. It stems from unsanitized bash arithmetic evaluation of the remoteVersion parameter in the thin-scc-wrapper component via WebSocket connections, allowing unauthenticated OS command injection. BeyondTrust patched cloud instances automatically on February 2, 2026, but approximately 8,500 self-hosted deployments require manual updates. Active exploitation campaigns have been observed by Arctic Wolf, Unit 42, and CISA, targeting financial, legal, healthcare, and tech sectors across multiple countries. Attackers are deploying tools like SimpleHelp, SparkRAT, and VShell, creating domain admin accounts, and performing lateral movement. A public proof-of-concept exploit exists, and many affected Bomgar B-series appliances have reached end of life, complicating remediation.

Critical Vulnerability CVE-2026-1731 Addressed by BeyondTrust