On February 6, 2026, BeyondTrust released a security advisory regarding CVE-2026-1731, an unauthenticated remote code execution issue within their remote support software. The vulnerability allows attackers to execute operating system commands with high privileges, potentially leading to unauthorized access and data exfiltration.
Unit 42 has observed attackers leveraging this vulnerability through network reconnaissance, webshell deployment, command-and-control traffic, backdoor and remote management tool installation, lateral movement, and data theft across multiple sectors including financial services, legal services, high technology, higher education, wholesale and retail, and healthcare. The U.S. CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities (KEV) Catalog on February 13, 2026.
Palo Alto Networks' Cortex Xpanse has identified over 16,400 potentially vulnerable instances based on telemetry data. Customers are advised to manually patch any unpatched instances and engage Palo Alto Networks’ Incident Response team for assessments.