Critical BeyondTrust RCE Actively Exploited to Seize Windows Domain Control

CyberDefender 6 mins0

A critical Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-1731, has been confirmed as actively exploited by threat actors to obtain full Windows domain control in unpatched, self-hosted BeyondTrust Remote Support and Privileged Remote Access environments. What makes this flaw particularly dangerous is that it can be triggered without authentication or user interaction, enabling remote attackers to execute arbitrary commands on vulnerable servers.

This vulnerability stems from an OS command injection weakness in HTTP request handling that allows an attacker to run system-level commands in the context of the site user/process.

Affected Software and Patch Status

  • Remote Support (RS): versions 25.3.1 and earlier are vulnerable.
  • Privileged Remote Access (PRA): versions 24.3.4 and earlier are vulnerable.
  • Fixed versions have been released — RS 25.3.2 and PRA 25.1.1 or later.

Cloud-hosted BeyondTrust customers have received automatic patches as of February 2, 2026, but self-hosted instances must update manually.

Exploitation Chain and Attack Behavior

According to Arctic Wolf telemetry observed in operational environments:

  1. Unauthenticated Initial Access – Exploit payloads are delivered via crafted HTTP requests to vulnerable BeyondTrust appliances, triggering OS command execution.
  2. Privilege Escalation & Persistence – Once code execution is achieved, attackers run commands under the high-privilege SYSTEM account. They have deployed remote monitoring management tools such as SimpleHelp (renamed binaries dropped to ProgramData) to establish persistence on the host.
  3. Network Reconnaissance – Standard Windows discovery commands (e.g., net share, systeminfo, ipconfig /all) are used to profile the environment, followed by Active Directory enumeration (e.g., leveraging AdsiSearcher).
  4. Domain Abuse and Lateral Movement
    • New domain accounts are created (net user) and added to high-privilege groups (Domain Admins, Enterprise Admins) via net group, effectively granting domain-wide control.
    • Tools like PSExec and Impacket-based SMB sessions are used for spreading across hosts.

Reconnaissance and Exploit Availability

Public proof-of-concept (PoC) code for CVE-2026-1731 was published shortly after disclosure, and large-scale scanning activity targeting exposed BeyondTrust instances has been detected by threat intelligence platforms. Reconnaissance hits have been observed within 24 hours of PoC release, a typical pattern seen with high-impact vulnerabilities.

Why This Matters

BeyondTrust RS and PRA are widely used in enterprise environments as privileged access and remote support platforms. These systems often sit at the boundary of secure networks and have deep integration with Active Directory, making them attractive targets:

  • They typically have privileged access rights, allowing broad control over endpoints and servers they support.
  • They are often exposed to management networks or externally reachable for remote support.
  • An unauthenticated RCE in these products can thus translate rapidly into full enterprise compromise — from initial access to domain control.

If exploitation succeeds, attackers can:

  • Establish persistent footholds with system-level access.
  • Enumerate and manipulate Active Directory objects.
  • Create high-privilege accounts and modify group memberships.
  • Spread laterally to other systems with elevated credentials.

Mitigation and Defensive Guidance

Immediate actions for organizations running self-hosted BeyondTrust:

  1. Patch Affected Systems – Apply official updates or upgrade to fixed product versions. Validate patching with authenticated vulnerability scanning.
  2. Restrict Network Exposure – Isolate BeyondTrust appliances behind trusted management networks and minimize direct internet exposure.
  3. Harden Access Controls – Enforce strong authentication (e.g., phishing-resistant MFA for administrative interfaces) and reduce reliance on implicit trust.
  4. Threat Hunting and Monitoring – Look for:
    • Unexpected service binaries (e.g., unauthorized SimpleHelp).
    • Suspicious SYSTEM-level command executions.
    • Newly created domain accounts or privilege group changes.
    • PSExec and SMB session anomalies consistent with lateral movement.
  5. Incident Response Preparedness – Test response processes for rapid domain compromise scenarios and ensure centralized logging/monitoring (e.g., SIEM, XDR).

Key Takeaways

  • CVE-2026-1731 is a critical, unauthenticated OS command injection vulnerability in BeyondTrust RS and PRA products.
  • It is being actively exploited to pivot from initial compromise to full Windows domain administration in self-hosted environments.
  • The quick availability of PoC and reconnaissance scanning greatly increases the urgency for remediation.
  • Effective mitigation combines patching, network segmentation, access hardening, and ongoing threat detection.

CyberDefender