CVE-2026-1731
Essential information
- Published
- 13/02/2026 01:00
- Modified
- 20/02/2026 14:14
- Author
- Cybersecurity and Infrastructure Security Agency
- Creator
- Cybersecurity and Infrastructure Security Agency
- CVSS
- 9.8 CRITICAL (v3.1) 9.9 CRITICAL (v4.0)
- CISA KEV
- Yes
- CWE
- —
- CVSS vector
-
—
CVSS:3.1/AV:N/C:H/I:H/A:HCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS metrics
- Access vector
- —
- Access complexity
- —
- Authentication
- —
- Confidentiality impact
- —
- Integrity impact
- —
- Availability impact
- —
- Exploitability
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- Network
- Attack complexity
- —
- Privileges required
- —
- User interaction
- —
- Scope
- —
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
- Exploit code maturity
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- NETWORK
- Attack complexity
- LOW
- Attack requirements
- NONE
- Privileges required
- NONE
- User interaction
- NONE
- Confidentiality (V)
- HIGH
- Confidentiality (S)
- LOW
- Integrity (V)
- HIGH
- Integrity (S)
- HIGH
- Availability (V)
- HIGH
- Availability (S)
- LOW
- Exploit maturity
- NOT_DEFINED
Description
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
NVD status
- Status
- Received — CVE has been recently published to the CVE List and has been received by the NVD.
- Source
- 13061848-ea10-403d-bd75-c83a022c2891
- NVD
- View on NVD
Affected products (CPE)
| Product | CPE |
|---|---|
| beyondtrust / beyondtrust remote support | cpe:2.3:a:beyondtrust:beyondtrust_remote_support:*:*:*:*:*:*:*:* |
| beyondtrust / privileged remote access | cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:* |