BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

Critical Threat Advisory: This vulnerability is documented in active Ransomware campaigns. Immediate remediation required.

Technical Severity

CVSS v3.1 Metrics

CRITICAL

9.8 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

49.74 %

Predictive Probability

Percentile Rank

97.7 th

Documented as more likely to be exploited than 97.7% of known CVEs.

Detection Date

Feb 13, 2026

Remediation Due

Feb 16, 2026

CISA Catalog Active

Threat Analysis

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.

Remediation Directive

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

External Intelligence

Please adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see:

https://www.beyondtrust.com/trust-center/security-advisories/bt26-02

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2026-1731