BeyondTrust remote support flaw under active attack, Cyber Centre warns

The Canadian Centre for Cyber Security issued an alert on Feb. 16, 2026, about a critical flaw in BeyondTrust Remote Support and Privileged Remote Access that attackers were exploiting. The bug, CVE-2026-1731, lets an unauthenticated attacker run operating system commands on a self-hosted appliance.

BeyondTrust's tools give IT staff and outside contractors remote control of company computers, so a compromised appliance can become a ready-made path into the rest of a network. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on Feb. 13 and has since marked it as known to be used in ransomware campaigns.

What happened

BeyondTrust published security advisory BT26-02 on Feb. 6. It describes an OS command injection weakness that can be triggered with specially crafted requests, executing commands in the context of the site user. NVD lists a CVSS 3.1 score of 9.8, and BeyondTrust scored it 9.9 under CVSS 4.0.

The company said it patched all Remote Support and Privileged Remote Access software-as-a-service customers by Feb. 2. Self-hosted customers who are not subscribed to automatic updates must apply the patch themselves.

The Cyber Centre's alert AL26-003 said it had seen open-source reporting of exploitation. It pointed to research from GreyNoise, which documented reconnaissance aimed at the flaw shortly after disclosure.

Remote access software has become a favoured entry point for ransomware crews because it is built to give outsiders deep control of internal machines. Appliances left exposed to the internet and outside automatic update channels are the most at risk.

Affected versions

• Remote Support 25.3.1 and earlier: apply patch BT26-02-RS (for versions 21.3 to 25.3.1) or upgrade to 25.3.2 or later.
• Privileged Remote Access 24.3.4 and earlier: apply patch BT26-02-PRA (for versions 22.1 to 24.x) or upgrade to 25.1 or later.

What to do

• Confirm whether your appliance is self-hosted and patch it now if automatic updates are off.
• Review logs for anomalies and unauthorized access.
• If you cannot patch immediately, restrict management interfaces with firewall rules or IP allow lists, or take exposed instances offline until patched.
• Report any activity matching the alert to the Cyber Centre through My Cyber Portal or [email protected].

The Cyber Centre also pointed organizations to its top 10 IT security actions, with emphasis on patching, hardening systems and isolating web-facing applications.