BeyondTrust CVE-2026-1731 Actively Exploited for Domain Takeover
2 min. read 
Published on
Attackers exploit a critical BeyondTrust vulnerability, CVE-2026-1731, in the wild to run OS commands and seize full domain control. This unauthenticated flaw hits self-hosted Remote Support (RS) and Privileged Remote Access (PRA) deployments via crafted HTTP requests.
The issue scores 9.8 on CVSS. It lets remote actors execute code under site user privileges without login. Cloud-hosted BeyondTrust fixed it automatically on February 2, 2026. Self-hosted users must patch manually now.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
Arctic Wolf spotted real attacks. Threat actors drop SimpleHelp Remote Access tools post-breach. They create admin accounts and scout networks for deeper access.
BeyondTrust released patches BT26-02-RS and BT26-02-PRA. RS versions up to 25.3.1 and PRA up to 24.3.4 need upgrades first if below 21.3 or 22.1.
CISA added it to Known Exploited Vulnerabilities catalog. Federal agencies must patch by March 10, 2026.
Arctic Wolf shared attack observations.Â
Technical Breakdown
Attackers craft HTTP requests to inject commands. Exploit runs under SYSTEM via Bomgar processes. Malware lands in ProgramData as remote access.exe.
Post-exploit steps include net user/group for Domain Admin rights. Recon uses AdsiSearcher, net share, ipconfig, and systeminfo. PSExec and Impacket spread SimpleHelp across hosts.
| Product | Affected Versions | Fixed By | Patch Notes |
|---|---|---|---|
| Remote Support (RS) | 25.3.1 and prior | BT26-02-RS (21.3–25.3.1) | Upgrade first if below 21.3 |
| Privileged Remote Access (PRA) | 24.3.4 and prior | BT26-02-PRA (22.1–24.X) | Upgrade first if below 22.1 |
Attack Indicators
- SimpleHelp binaries in ProgramData.
- New privileged accounts via net user/group.
- SMBv2 sessions with Impacket tools.
- AdsiSearcher and network enum commands.
Cloud users stay safe. Self-hosted admins, hunt these signs on domains.
Mitigation Actions
- Apply BeyondTrust patches immediately.
- Hunt for SimpleHelp files and rogue admins.
- Block unusual SMB traffic.
- Review logs for command injection.
- Upgrade old versions before patching.
FAQ
Unauthenticated OS command execution leading to domain admin.Â
Self-hosted RS up to 25.3.1 and PRA up to 24.3.4.
Yes, auto-patched February 2, 2026.
SimpleHelp remote access.exe, PSExec, Impacket.
Yes, in KEV catalog. Patch deadline March 10
Patch, scan for IOCs, monitor Active Directory changes.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages