BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration
Security researchers have observed attackers weaponizing a recently disclosed critical bug in BeyondTrust Remote Support (RS) and certain versions of Privileged Remote Access (PRA). The weakness has been abused to carry out a variety of malicious operations – from dropping web shells and persistent backdoors to installing remote management utilities and stealing sensitive information – with reports noting deployments of tools such as VShell and Spark RAT.
The issue, cataloged as CVE-2026-1731 and assigned a CVSS score of 9.9, permits adversaries to run operating-system-level commands under the permissions of the site user account. In a Thursday advisory, Palo Alto Networks Unit 42 said it has observed real-world exploitation of the vulnerability for tasks including reconnaissance, web shell installation, command-and-control activity, backdoor and remote management tool installation, lateral movement across networks, and data theft.
Unit 42 reported that the campaign has touched multiple industries – financial services, legal, high tech, higher education, wholesale and retail, and healthcare – with victims located across the United States, France, Germany, Australia, and Canada. The firm described the flaw as a sanitization failure that allows attackers to abuse a vulnerable “thin-scc-wrapper” script exposed via a WebSocket interface to inject and execute arbitrary shell commands with the site user’s privileges.
According to researcher Justin Moore, the compromised site user is not the root account, but gaining control of it effectively hands attackers the ability to alter the appliance’s configuration, manage sessions and intercept or manipulate network traffic handled by the device.
Observed techniques in the intrusive campaign include using a bespoke Python utility to escalate access to an administrative account; planting multiple web shells in different directories – including a PHP-based backdoor that can execute raw PHP or run arbitrary PHP without creating new files on disk – and deploying a bash dropper to maintain a persistent web shell. Attackers have also installed malware such as VShell and Spark RAT, used out-of-band application security testing (OAST) methods to confirm successful code execution and fingerprint compromised systems, and issued commands to collect, compress and exfiltrate sensitive artifacts like configuration files, internal system databases and a complete PostgreSQL dump to external servers.
Unit 42 highlighted a connection between CVE-2026-1731 and an earlier flaw, CVE-2024-12356, noting both reflect recurring, localized input-validation deficiencies in different execution paths. While CVE-2024-12356 stemmed from inadequate validation tied to third-party software (Postgres), CVE-2026-1731 originates in the BeyondTrust RS codebase and older PRA releases. Given that CVE-2024-12356 was exploited by China-linked groups such as Silk Typhoon, Unit 42 warned that CVE-2026-1731 may likewise attract advanced threat actors.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog entry for CVE-2026-1731 to confirm that the flaw is being leveraged in ransomware operations, underscoring the urgency for affected organizations to investigate and remediate vulnerable BeyondTrust appliances.