Reconnaissance Has Begun for the New Beyond Trust RCE (CVE-2026-1731): Here's What We See So Far
Summary: A proof-of-concept exploit for CVE-2026-1731, a pre-authentication OS command injection flaw (CVSS v4: 9.9) in BeyondTrust Remote Support and Privileged Remote Access, was posted to GitHub on February 10, and by February 11 GreyNoise's sensor network was recording reconnaissance probing for vulnerable instances. A single IP tied to a commercial VPN hosted in Frankfurt accounts for 86% of observed reconnaissance sessions, and scanners systematically probed clusters of non-standard ports rather than the default HTTPS port 443.
What you should know: CVE-2026-1731 is a variant of CVE-2024-12356, the same vulnerability class Silk Typhoon used to breach the U.S. Treasury Department in late 2024, and self-hosted customers remain exposed until they manually update to RS v25.3.2+ or PRA v25.1.1+.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-12356CVE-2026-1731
- Related
- CVE-2026-1731: Beyond Trust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability Known Exploited Vulnerabilities · Feb 13, 2026CVE-2024-12356: Beyond Trust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability Known Exploited Vulnerabilities · Dec 19, 2024