On February 6, 2026, BeyondTrust published a security advisory warning about CVE-2026-1731, a critical vulnerability affecting its Remote Support and Privileged Remote Access products.
BeyondTrust provides identity and access management solutions used by enterprises worldwide. The flaw is a pre-authentication remote code execution (RCE) vulnerability with a CVSS score of 9.9.
It impacts the thin-scc-wrapper component, which processes WebSocket connections. Because the bug can be exploited without authentication, attackers can execute operating system commands as the site user.
This can lead to full system compromise, data theft, and service disruption. Researchers from Unit 42 confirmed active exploitation in the wild.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026, requiring federal agencies to patch immediately.
Telemetry from Cortex Xpanse identified more than 16,400 exposed instances vulnerable to CVE-2026-1731 at the time of reporting.
Exploitation Mechanism and Post-Compromise Activity
The vulnerability stems from improper input validation during the WebSocket handshake process. The thin-scc-wrapper script evaluates a client-supplied remoteVersion parameter using bash arithmetic expansion.
Because bash arithmetic contexts can interpret expressions, attackers can inject malicious command substitutions such as $(command).
By sending a specially crafted value like a[$(cmd)]0, attackers force the script to execute arbitrary shell commands. No user interaction or login is required.
Unit 42 observed attackers conducting network reconnaissance, creating domain and local administrator accounts, and deploying web shells.
In several cases, attackers used a custom Python script to temporarily reset the main administrator password hash for 60 seconds, granting stealth access before restoring the original credentials and deleting evidence.
Multiple PHP web shells were discovered, including compact one-line backdoors using the eval() function. Some variants resembled tools such as China Chopper, using encoded parameters to execute commands and return output.
Attackers also deployed remote access tools, including SparkRAT and VShell. SparkRAT, written in Go, provides cross-platform remote control. VShell is a stealthy Linux backdoor known for fileless execution and service masquerading.
Additional activity included DNS-based data exfiltration, reverse shells over port 4444, and attempts to install tools such as SimpleHelp and AnyDesk.
| CVE ID | CVSS Score | Description | Vector |
|---|---|---|---|
| CVE-2026-1731 | 9.9 | Pre-auth RCE via thin-scc-wrapper OS command injection | Network/WebSocket |
Impacted sectors include financial services, legal services, healthcare, higher education, retail, and high technology organizations across the United States, France, Germany, Australia, and Canada.
According to Paloalto Networks, security teams are strongly advised to patch immediately, restrict management interfaces to segmented networks, and monitor for indicators of compromise.
Defense-in-depth controls remain critical, especially for high-value remote access platforms exposed to the internet.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
