BeyondTrust pre-auth RCE: what it means for privileged access teams

TL;DR: Critical pre-authentication RCE in BeyondTrust Remote Support and Privileged Remote Access drew reconnaissance within 24 hours of a public PoC, according to GreyNoise, with 86% of observed sessions tied to one scanner and activity spanning other exploited products. Privileged access infrastructure should be treated as a high-value exposure path, not a perimeter convenience.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far”.

By the numbers:

• CVE-2026-1731 has a CVSS v4 score of 9.9, reflecting the severity of the unauthenticated command injection flaw.

Key questions

Q: What breaks when a privileged access gateway is exposed to unauthenticated RCE?

A: The gateway stops being a neutral broker and becomes a direct execution path into the identity plane.

Q: Why does public exploit code for a remote access flaw change risk so quickly?

A: Public exploit code lowers the effort required to find and target vulnerable systems.

Q: How should security teams prioritise patching when legacy systems still run in production?

A: Security teams should treat patching as a managed programme, not a fire drill.

Practitioner guidance

• Harden internet-facing privileged access gateways Inventory every BeyondTrust deployment, confirm whether it is cloud managed or self-hosted, and verify that exposed instances are not left reachable on unintended ports or through default assumptions about visibility.
• Prioritise emergency patch validation Confirm self-hosted systems are updated to RS v25.3.2+ or PRA v25.1.1+ and verify that the vulnerable code path is no longer reachable through any published endpoint.
• Correlate scanner activity with asset exposure Use external reconnaissance signals to identify which privileged access servers are being probed, then cross-check those hosts against your own exposure records and change windows.

Bottom line: CVE-2026-1731 matters because it turns a privileged access platform into an unauthenticated command-execution surface before identity controls can intervene.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →