VShell and SparkRAT Observed in Exploitation of Beyond Trust Critical Vulnerability (CVE-2026-1731)
Summary: BeyondTrust released an advisory on Feb. 6, 2026 for CVE-2026-1731, a pre-authentication remote code execution flaw in the thin-scc-wrapper component of its remote support software that handles WebSocket connections and evaluates the client-supplied remoteVersion value in bash arithmetic contexts. Unit 42 observed exploitation followed by installation of PHP web shells, the SparkRAT and VShell backdoors, a 60-second takeover of administrator User ID 1 via a self-deleting Python script, and DNS-based exfiltration through Burp Suite Collaborator, with Cortex Xpanse identifying 16,400-plus exposed instances and CISA adding the flaw to its KEV Catalog on Feb. 13, 2026.
Why it matters: The prior flaw in this same component, CVE-2024-12356, was exploited by Silk Typhoon in a 2024 breach of the U.S. Treasury, and 16,400-plus exposed instances now carry a CVSS 9.9 flaw that needs no credentials or user interaction.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-1731
- Related
- CVE-2026-1731: Beyond Trust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability Known Exploited Vulnerabilities · Feb 13, 2026Reconnaissance Has Begun for the New Beyond Trust RCE (CVE-2026-1731): Here's What We See So Far Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026