Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far

On February 10, a proof-of-concept exploit for CVE-2026-1731, a critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access, was posted to GitHub. By February 11, GreyNoise’s Global Observation Grid was recording reconnaissance probing for vulnerable BeyondTrust instances.

CVE-2026-1731 is an OS command injection flaw (CVSS v4: 9.9) that lets an unauthenticated attacker execute arbitrary commands on a BeyondTrust Remote Support or Privileged Remote Access server. No credentials required. No user interaction needed. Low complexity to exploit.

It's a variant of CVE-2024-12356, the same vulnerability class that Chinese state-sponsored group Silk Typhoon used to breach the U.S. Treasury Department in late 2024. Same WebSocket endpoint, different code path.

BeyondTrust patched cloud customers automatically on February 2. Self-hosted customers need to update manually to RS v25.3.2+ or PRA v25.1.1+.

Our global sensor network, a passive collection of sensors that observe and classify internet-wide scanning and reconnaissance activity, detected a clear surge beginning February 11, 2026. This is the reconnaissance phase; what comes next is predictable.

A single IP accounts for 86% of all observed reconnaissance sessions so far. It's associated with a commercial VPN service hosted by a provider in Frankfurt and has been an active scanner in our data since 2023. This isn't a new actor; it's an established scanning operation that rapidly added CVE-2026-1731 checks to its toolkit.
‍

Standard BeyondTrust deployments run on HTTPS (port 443), but few sessions target that port. The rest systematically probed clusters of non-standard ports, suggesting the attackers know that enterprises often move BeyondTrust to non-default ports for security-through-obscurity.  
‍

3. JA4+ fingerprints reveal shared tooling and VPN tunneling