CVE-2026-1731: listed in the CISA KEV catalog

CVE-2026-1731 · CVSS 9.8 CRITICAL · EPSS 91% · KEV 2026-02-13

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.

Is CVE-2026-1731 exploited?

• Listed in the CISA KEV catalog on 2026-02-13.
• Federal remediation due 2026-02-16.
• Past that date by 226 days.
• Used in ransomware campaigns.
• EPSS puts exploitation in the next 30 days at 91%.
• Public exploit code: packaged in a public tool.
• Public detection rules exist.

Which products and versions are affected?

• BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA) · 0 - RS 25.3.1, 0 - PRA 24.3.4

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-1731

• GTIG Sees AI Pushing Flaws Into Faster Exploitation (2026-09-30)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/linux/http/beyondtrust_pra_rs_command_injection
• Nuclei template

What this record does not say

• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-09-30.