Industry Newsremote accessos command injectionbeyondtrustvulnerability
BeyondTrust Discloses Critical Zero-Day Remote RCE
8.2
BeyondTrust issued an urgent advisory on February 2, 2026, warning of CVE-2026-1731, a pre-authentication remote code execution vulnerability with a CVSSv4 score of 9.9 that affects self-hosted Remote Support (<=25.3.1) and Privileged Remote Access (<=24.3.4). BeyondTrust patched all SaaS instances on February 2 and advises self-hosted customers to upgrade to RS 25.3.2 and PRA 25.1.1 immediately.
Key Points
- 1Identifies CVE-2026-1731 as pre-authentication RCE with CVSSv4 9.9 and OS command injection
- 2Highlights high impact because unauthenticated attackers can execute system commands as site user
- 3Advises practitioners to patch self-hosted RS to 25.3.2 and PRA to 25.1.1 immediately
Scoring Rationale
High practical urgency due to unauthenticated RCE and official patches, limited to BeyondTrust self-hosted deployments.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
