Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability

Multiple high-severity vulnerabilities are being actively exploited: BeyondTrust products are facing in‑the‑wild pre‑auth RCE exploitation (CVE‑2026‑1731) and CISA added four other exploited CVEs to its KEV list, including an Apple zero‑day and a SolarWinds/Notepad++ related set. The report highlights a Notepad++ update supply‑chain compromise attributed to China‑linked Lotus Blossom that delivered the Chrysalis backdoor to selected targets, notes available patches and FCEB remediation deadlines, and underscores rapid weaponization of disclosed flaws.