Beyond Trust Flaw Used for Web Shells, Backdoors, and Data Exfiltration
Summary: Threat actors are exploiting CVE-2026-1731, a CVSS 9.9 command-injection flaw in BeyondTrust Remote Support and Privileged Remote Access, to run reconnaissance, deploy web shells and VShell and Spark RAT, move laterally, and steal data. Palo Alto Networks Unit 42 reported the activity across financial services, legal services, high technology, higher education, wholesale and retail, and healthcare in the U.S., France, Germany, Australia, and Canada, and CISA's KEV entry now confirms exploitation in ransomware campaigns.
What's compelling: BeyondTrust first saw exploitation on January 31, 2026, a week before public disclosure on February 6, and observed activity was limited to internet-facing, self-hosted appliances left unpatched before February 9 - a window that put appliance configuration, managed sessions, and network traffic in attacker hands.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2024-12356CVE-2026-1731
- Related
- Reconnaissance Has Begun for the New Beyond Trust RCE (CVE-2026-1731): Here's What We See So Far Cyber Risks ·CVE-2026-1731: Beyond Trust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability Known Exploited Vulnerabilities · Feb 13, 2026