Critical BeyondTrust RCE flaw now exploited in attacks, patch now

Critical pre-auth remote code execution vulnerability CVE-2026-1731 (CVSS 9.9) impacting BeyondTrust Remote Support (≤25.3.1) and Privileged Remote Access (≤24.3.4) is being actively exploited after a PoC was published; attackers abuse the /get_portal_info endpoint to obtain the X-Ns-Company value and establish WebSocket channels to execute commands. BeyondTrust auto-patched cloud SaaS instances on Feb 2, 2026, but on-premises deployments (~8,500 of ~11,000 exposed) require manual patching—unpatched systems should be assumed compromised and patched immediately.