Researchers Observe In-the-Wild Exploitation of Beyond Trust CVSS 9.9 Vulnerability
Summary: watchTowr reported observing first in-the-wild exploitation of CVE-2026-1731, a CVSS 9.9 flaw in BeyondTrust Remote Support and Privileged Remote Access that lets an unauthenticated attacker execute operating system commands as the site user, with attackers abusing get_portal_info to extract the x-ns-company value before establishing a WebSocket channel. GreyNoise said it saw reconnaissance targeting the flaw less than 24 hours after a proof-of-concept exploit appeared, with a single IP tied to a commercial VPN provider in Frankfurt accounting for 86% of observed reconnaissance sessions, and Arctic Wolf reported attacks attempting to deploy the SimpleHelp RMM tool for persistence and lateral movement using AdsiSearcher, PSexec, and Impacket SMBv2 requests.
What's compelling: A single IP on a commercial VPN in Frankfurt carried 86% of the reconnaissance against this flaw within a day of the PoC, and CISA set a February 16, 2026 remediation deadline for federal agencies - the gap between public exploit code and someone probing your BeyondTrust deployment is now measured in hours, not weeks.