BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration

Palo Alto Networks Unit 42 and reporting indicate active in-the-wild exploitation of CVE-2026-1731 (CVSS 9.9) in BeyondTrust RS/PRA appliances, enabling remote OS command execution via a WebSocket-accessible script; attackers have leveraged the flaw to obtain administrative access, deploy web shells and malware (including VShell and Spark RAT), perform lateral movement and exfiltrate sensitive data, and the issue has been added to CISA's KEV catalog and observed in ransomware activity—primary impact is on internet-facing, self-hosted appliances where patches were not applied.