Exploiting BeyondTrust Vulnerabilities for Malicious Purposes

Exploitation of Critical BeyondTrust Security Flaw Unleashes Malicious Campaign

Recently, threat actors have been leveraging a critical security vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to carry out various malicious activities. This flaw, identified as CVE-2026-1731 with a CVSS score of 9.9, enables attackers to execute operating system commands within the site user’s context.

A report from Palo Alto Networks Unit 42 has revealed active exploitation of this vulnerability in the wild, leading to network reconnaissance, web shell deployment, command-and-control operations, backdoor and remote management tool installations, lateral movement, and data theft.

The targeted industries include financial services, legal services, high technology, higher education, wholesale and retail, and healthcare sectors in the U.S., France, Germany, Australia, and Canada.

Described as a sanitization failure, the vulnerability allows attackers to exploit the “thin-scc-wrapper” script through a WebSocket interface to inject and execute arbitrary shell commands in the site user’s context. Security researcher Justin Moore emphasized that compromising this account grants attackers control over the appliance’s configuration, managed sessions, and network traffic.

Scope of Attacks

The attacks exploiting the flaw encompass a range of activities:

• Utilizing a custom Python script to gain access to an administrative account.
• Installing multiple web shells, including a PHP backdoor and a bash dropper for persistent web shell establishment.
• Deploying malware such as VShell and Spark RAT.
• Employing out-of-band application security testing techniques to validate successful code execution and identify compromised systems.
• Executing commands to stage, compress, and exfiltrate sensitive data to an external server.

Unit 42 highlighted the interconnectedness between CVE-2026-1731 and CVE-2024-12356, emphasizing the recurring challenge of input validation in distinct execution pathways. While CVE-2024-12356 involved insufficient validation using third-party software, CVE-2026-1731’s issue stemmed from the BeyondTrust Remote Support (RS) and older versions of the BeyondTrust Privileged Remote Access (PRA) codebase.

Notably, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities catalog to confirm exploitation of CVE-2026-1731 in ransomware campaigns.