Signal
BeyondTrust patches critical pre-auth RCE (CVE-2026-1731) in RS and PRA
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-02-09 08:03 UTCUpdated 2026-02-09 19:05 UTC
rss
cvercevulnerabilityadvisorypatchingremote_access_tools
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
Security researchers and news outlets are flagging a critical pre-authentication remote code execution flaw in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). BeyondTrust has issued updates, and coverage emphasizes that self-hosted deployments need manual patching to reduce exposure.
Entities
BeyondTrustRemote Support (RS)Privileged Remote Access (PRA)
Score total
1.02
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- BeyondTrust has released updates addressing the issue
- Fresh reporting is amplifying patch urgency for RS and PRA users
- Critical severity framing increases likelihood of rapid attacker interest
Why it matters
- Pre-auth RCE can enable full compromise without valid credentials
- Remote support/access tools are high-value targets in enterprise environments
- Self-hosted instances need manual patching to reduce exposure
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- BeyondTrust released updates/advisory for a critical pre-authentication RCE affecting Remote Support (RS) and Privileged Remote Access (PRA).
- The issue is tracked as CVE-2026-1731 and is described as critical, enabling unauthenticated remote attackers to execute arbitrary OS commands via crafted requests.
- Self-hosted customers remain at risk until they apply manual updates; SaaS instances were automatically patched (per Rapid7’s write-up).
How sources frame it
- Rapid7: neutral
- The Hacker News: neutral
All evidence
All evidence
CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
Rapid7 Blog · rapid7.com · 2026-02-09 19:05 UTC
BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA
The Hacker News · thehackernews.com · 2026-02-09 08:03 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- Rapid7 Blog (1)
- The Hacker News (1)
Top origin domains (this list)
- rapid7.com (1)
- thehackernews.com (1)