Surge in Exploitation of BeyondTrust Vulnerability CVE-2026-1731

A critical security flaw, designated CVE-2026-1731, has been identified in BeyondTrust Remote Support and Privileged Remote Access products, allowing unauthenticated attackers to execute arbitrary operating system commands. This vulnerability, which has a CVSS score of 9.9, poses significant risks, including unauthorized access and data exfiltration. Security researchers have reported the first instances of in-the-wild exploitation, with reconnaissance activities escalating shortly after a proof-of-concept exploit was made available.

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 VulnerabilityCybersecurityDive

The exploitation of CVE-2026-1731 began to be observed on February 6, 2026, with a notable increase in reconnaissance activity linked to a single IP address associated with a commercial VPN in Frankfurt, Germany. This activity was reported by GreyNoise, which noted that the scanning efforts intensified within 24 hours of the proof-of-concept release. Ryan Dewhurst, head of threat intelligence at watchTowr, confirmed the initial exploitation attempts on February 8, 2026.

CybersecurityDive

BeyondTrust has released patches for its products, specifically for versions 21.3 to 25.3.1 of Remote Support and versions 22.1 to 24.X of Privileged Remote Access. Cloud customers have been automatically updated, while self-hosted customers are advised to apply the necessary upgrades. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-1731 to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the urgency for organizations to address this flaw.

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 VulnerabilityCybersecurityDive

Despite the patches, concerns remain regarding the rapid exploitation of newly disclosed vulnerabilities. Researchers have highlighted the potential for increased attacks as threat actors quickly adapt to new security weaknesses. The situation is compounded by the fact that the vulnerability is similar to one previously exploited by the state-linked threat group Silk Typhoon in a 2024 breach of the U.S. Treasury Department.

CybersecurityDive

While the initial exploitation attempts have been confirmed, the extent of the attacks remains unclear. Some researchers, including those from watchTowr, have indicated that exploitation attempts have been limited thus far, suggesting that the situation may evolve rapidly. Additionally, there is no definitive information on the identity of the attackers or the scale of their operations.

CybersecurityDive

“Overnight we observed first in-the-wild exploitation of BeyondTrust across our global sensors,” — Ryan Dewhurst, Head of Threat Intelligence at watchTowr

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability

“Probes and exploitation attempts have been quite limited so far,” — watchTowr spokesperson

CybersecurityDive

“ "By abusing a legitimate update mechanism relied upon specifically by developers and administrators, they transformed routine maintenance into a covert entry point for high-value access.” — LevelBlue SpiderLabs report

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability

Organizations using BeyondTrust products are urged to implement the latest patches immediately. CISA has set deadlines for Federal Civilian Executive Branch agencies to address CVE-2025-40536 by February 15, 2026, and the remaining vulnerabilities by March 5, 2026. As the situation develops, further monitoring of exploitation attempts is essential to safeguard against potential breaches.

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability