The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies on Friday to secure their BeyondTrust Remote Support instances against an actively exploited vulnerability within three days. BeyondTrust provides identity security services to more than 20,000 customers across over 100 countries, including government agencies and 75% of Fortune 100 companies worldwide. Tracked as CVE-2026-1731, this remote code execution vulnerability stems from an OS command injection weakness and affects BeyondTrust's Remote Support 25.3.1 or earlier and Privileged Remote Access 24.3.4 or earlier. While BeyondTrust patched all Remote Support and Privileged Remote Access SaaS instances on February 2, 2026, on-premise customers must install patches manually. "Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user," BeyondTrust said when it patched the vulnerability on February 6. "Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption." Hacktron, who discovered the vulnerability and responsibly disclosed it to BeyondTrust on January 31, warned that approximately 11,000 BeyondTrust Remote Support instances were exposed online, around 8,500 of them being on-premises deployments. On Thursday, six days after BeyondTrust released CVE-2026-1731 security patches, watchTo...
CISA gives feds 3 days to patch actively exploited BeyondTrust flaw
BleepingComputer
·Sergiu Gatlan
·Published Feb 16, 2026
·Updated
Affected Software
2 affected components
BeyondTrust Remote Support<=25.3.1
BeyondTrust Privileged Remote Access<=24.3.4
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses CISA's directive for federal agencies to patch a vulnerability in BeyondTrust Remote Support software.
2
What security implications are discussed in the article?
The article highlights that the vulnerability in BeyondTrust is actively exploited, posing significant security risks to federal agencies.
3
What products or software are affected by the vulnerability?
The affected products include BeyondTrust Remote Support (up to version 25.3.1) and BeyondTrust Privileged Remote Access (up to version 24.3.4).
4
What is the deadline set by CISA for federal agencies to address the vulnerability?
CISA has set a deadline of three days for federal agencies to patch the BeyondTrust flaw.
5
Why is it urgent for federal agencies to patch the BeyondTrust flaw?
It is urgent because the vulnerability is actively being exploited, which could lead to significant security breaches.