BeyondTrust Remote Support and PRA CVE-2026-1731: pre-auth command injection exploited before disclosure and used by ransomware

What happened

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) are remote-access appliances that usually face the internet. CVE-2026-1731 lets an unauthenticated attacker run operating system commands on them as the “site user” by sending crafted requests. It is rated CVSS v4 9.9 (CVE record).

Unit 42 traced the bug to the thin-scc-wrapper script, reached over a WebSocket. The script evaluates the client-supplied remoteVersion value in a bash arithmetic context, which runs any command substitution inside it. Earlier patches added numeric checks but did not stop the evaluation. The site user is not root, but it controls the appliance configuration, managed sessions and network traffic (Unit 42).

Timeline:

• 31 January 2026: exploitation detected, a week before disclosure, according to BeyondTrust’s later update (BleepingComputer).
• 2 February: SaaS instances patched automatically.
• 6 February: BeyondTrust published advisory BT26-02 (Unit 42). Proof-of-concept exploits appeared shortly after (BleepingComputer).
• 13 February: CISA added it to KEV with a three-day deadline (16 February). CISA’s catalog now marks it as known to be used in ransomware campaigns (CISA KEV).

Unit 42 saw attacks on financial services, legal services, high technology, higher education, retail and healthcare organisations in the United States, France, Germany, Australia and Canada. Attackers (Unit 42):

• created domain and local administrator accounts, and used a script that briefly takes over the appliance’s primary admin (user ID 1) for 60 seconds, then restores its password hash;
• dropped PHP web shells, including aws.php, file_save.php and maintenance.php. One bash script temporarily rewrote the Apache config to route requests to /ns/tmp/php-fpm.sock, restarted Apache, then restored the clean config;
• installed SparkRAT, the VShell Linux backdoor, the Nezha agent, SimpleHelp, AnyDesk, Cloudflare Tunnel and ligolo-ng;
• exfiltrated configuration files, internal databases and a full PostgreSQL dump.

A related earlier BeyondTrust flaw, CVE-2024-12356, was used by the China-linked group Silk Typhoon, including against the US Treasury (Unit 42).

Am I affected?

You are affected if you host BeyondTrust yourself and run Remote Support 25.3.1 or earlier or Privileged Remote Access 24.3.4 or earlier without the BT26-02 patch (CVE record). Check the version and installed patches in the appliance’s /appliance administration interface (BleepingComputer). Old releases cannot take the patch directly: Unit 42 says RS older than 21.3 and PRA older than 22.1 must upgrade first (Unit 42).

If the appliance was reachable from the internet before you patched, look for these signs (Unit 42):

• Unexpected child processes of bomgar-scc on Windows endpoints and on the appliance: cmd.exe or powershell.exe running net user and group commands, whoami, nltest, ntdsutil, or curl and wget; on Linux, curl, wget, nc, base64, python, /dev/tcp, useradd or crontab.
• Web shell names and hashes: aws.php (SHA-256 98442387d466f27357d727b3706037a4df12a78602b93df973b063462a677761), maintenance.php (66cceb2c2f1d9988b501832fd3b559775982e2fce4ab38fc4ffe71b74eafc726) and file_save.php.
• DNS lookups to oastify.com, oast.pro or oast.fun subdomains, used to exfiltrate data in hex-encoded labels.
• Network indicators: the VShell domain aliyundunupdate[.]xyz, file host transfer.weepee[.]io, and the IP list in Unit 42’s report.
• New admin users in the appliance, and new domain or local admin accounts created from systems the appliance reaches.

What to do now

1. Patch self-hosted appliances: Remote Support to 25.3.2, PRA to 25.1.1 or later. Turn on automatic updates if you can, and confirm the patch in /appliance (BleepingComputer).
2. Upgrade old versions first. If you are on RS before 21.3 or PRA before 22.1, move to a supported release, then apply the patch (Unit 42).
3. Hunt on the appliance and on endpoints for the web shells, processes and accounts listed above. A support tool that spawns ntdsutil or creates domain admins is an incident, not an alert to tune.
4. If you find compromise, treat the appliance and every system it had sessions with as in scope. Attackers took full PostgreSQL dumps and configuration files (Unit 42), so reset the credentials stored in or used through RS and PRA, including any credentials stored in PRA, and remove the remote-access tools listed above if you did not install them.
5. Limit exposure of the admin interface. Unit 42 recommends restricting administrative interfaces to segmented management networks or zero trust access gateways (Unit 42).

Sources

• BeyondTrust security advisory BT26-02 (vendor advisory; it could not be fetched for this write-up, so details here come from the sources below)
• CVE record: CVE-2026-1731
• Unit 42: threat brief on BeyondTrust CVE-2026-1731
• BleepingComputer: CISA says BeyondTrust RCE flaw now exploited in ransomware attacks
• CISA Known Exploited Vulnerabilities catalog