Pre-auth RCE in BeyondTrust
Overview
Hacktron’s agents identified a critical pre-authentication remote code execution (RCE) vulnerability in BeyondTrust Remote Support (RS) and older versions of Privileged Remote Access (PRA). This has been assigned CVE-
We found it through variant analysis, part of the autonomous scans we run across enterprise software, and disclosed it to BeyondTrust.
Impact
Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user.
BeyondTrust Remote Support and Privileged Remote Access are widely deployed in enterprises for remote access and privileged session management.
Affected versions
| Product | Affected versions |
|---|---|
| Remote Support (RS) | 25.3.1 and prior |
| Privileged Remote Access (PRA) | 24.3.4 and prior |
Fixed versions
| Product | Fixed versions |
|---|---|
| Remote Support (RS) | Patch BT26-02-RS 25.3.2 and later |
| Privileged Remote Access (PRA) | Patch BT26-02-PRA 25.1.1 and later |
Exposure analysis
Our Shodan and Fofa search for BeyondTrust Remote Support deployments found:
- About 11,000 instances are exposed to the internet, cloud and on-prem.
- About 8,500 of those are on-prem deployments, which stay vulnerable until they are patched.
- RS is commonly deployed in large enterprises, healthcare, financial services, government, and hospitality.
At this time, we are withholding technical details to allow affected parties sufficient time to apply patches. We strongly recommend addressing this vulnerability promptly, as exploitation is straightforward.
Recommended actions
- BeyondTrust patched all Remote Support SaaS customers by February 2, 2026.
- Self-hosted customers of Remote Support and Privileged Remote Access should manually apply the patch if their instance is not subscribed to automatic updates.
Disclosure timeline
-
Hacktron identifies the vulnerability through AI-enabled variant analysis
-
Initial disclosure report submitted to BeyondTrust security team
-
BeyondTrust confirms the vulnerability and begins patch development
-
BeyondTrust patches cloud deployments and releases patch for on-prem
-
BeyondTrust and Hacktron release advisory and CVE publication
Vendor response
BeyondTrust handled this disclosure exceptionally well. Its security team confirmed the vulnerability the day we reported it, deployed a patch to SaaS customers within 2 days, and coordinated the public disclosure timeline closely with us.
References
If you have questions about this advisory, email hello@hacktron.ai.