Article
Remote support and file transfer flaws in ransomware attacks
SimpleHelp, CrushFTP, GoAnywhere and BeyondTrust flaws were flagged by CISA for ransomware use in 2025 and 2026. Dates, fixes, attribution and checks.
Read more
Exploited vulnerability
BeyondTrust Remote Support and PRA command injection (CVE-2026-1731)
CVE-2026-1731
CVE-2026-1731 is a critical flaw in BeyondTrust Remote Support (RS) and some older versions of Privileged Remote Access (PRA), tools used to reach and manage systems remotely.
- On CISA KEV
- CVE ID
- CVE-2026-1731
- CISA KEV
- Listed
- Affected product
- Remote Support (RS) and Privileged Remote Access (PRA)
- Exploited
- Yes
- Published
- February 2026
In short
CVE-2026-1731 is a critical flaw in BeyondTrust Remote Support (RS) and some older versions of Privileged Remote Access (PRA), tools used to reach and manage systems remotely. An attacker on the internet can send crafted requests and run operating system commands, with no login. CISA lists it as exploited and flags ransomware use.
- CVECVE-2026-1731
- ProductBeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedFollow the vendor advisory · Compare your version
What it allows
An unauthenticated remote attacker can run operating system commands as the site user. CISA says exploitation needs no authentication or user interaction and may lead to system compromise, data theft and service disruption. CVSS: 9.8 (NVD, CVSS v3.1). NVD also lists a CVSS v4 score of 9.9 from the CVE entry's own source.
Who is affected
NVD lists Remote Support before 25.3.2 and Privileged Remote Access before 25.1 as affected. The NVD text says only certain older PRA versions are affected. The vendor advisory (BT26-02, named in the KEV entry) could not be opened for this page, so check it for exact patch versions and for the cloud-hosted versus self-hosted position.
NVD published the CVE on 6 February 2026. CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities (KEV) catalog on 13 February 2026, with a due date of 16 February 2026, only three days later. The KEV entry flags known use in ransomware campaigns.
The sources opened here give no date for first exploitation. CISA tells users to check for signs of compromise on all internet-facing BeyondTrust products affected by the flaw.
Attributed by CISA, FBI and MS-ISAC in the #StopRansomware Medusa advisory (updated 18 August 2026): the advisory names CVE-2026-1731 among the flaws Medusa actors exploit.
Who exploits it
What to do
-
Follow the vendor advisory
The KEV entry tells you to follow the vendor's guidelines to assess exposure and mitigate risk. Apply the patch the vendor names for your Remote Support or PRA version.
-
Compare your version
NVD lists Remote Support before 25.3.2 and PRA before 25.1 as affected. If you are below these, treat the system as exposed.
-
Reduce internet exposure
CISA's required action allows mitigations per vendor instructions, or stopping use of the product if mitigations are not available.
-
Assume possible compromise
CISA asks you to check all internet-facing BeyondTrust products for signs of compromise. The flaw needs no login, and CISA gave a three-day deadline.
-
Detect and hunt
Review the host for unexpected commands run by the site user and for new accounts or outbound connections. Use the indicators in the vendor advisory.
Questions
What is CVE-2026-1731?
CVE-2026-1731 is an OS command injection flaw in BeyondTrust Remote Support and some older Privileged Remote Access versions. An unauthenticated attacker can run operating system commands as the site user. NVD scores it 9.8.
Which versions are affected by CVE-2026-1731?
NVD lists Remote Support before 25.3.2 and Privileged Remote Access before 25.1. Only certain older PRA versions are affected. Check the vendor advisory for exact patch versions.
Is CVE-2026-1731 used in ransomware attacks?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 13 February 2026 with ransomware use flagged. The #StopRansomware Medusa advisory from CISA, FBI and MS-ISAC names it among the flaws Medusa actors exploit.
How do I protect against CVE-2026-1731?
Follow the vendor advisory and apply the patch for your version. Reduce internet exposure, check all internet-facing BeyondTrust products for signs of compromise, and review hosts for unexpected commands, new accounts or outbound connections.
In our research
Sources
- CVE-2026-1731 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- #StopRansomware: Medusa Ransomware CISA, FBI and MS-ISAC
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.