{"id":10683,"date":"2026-02-16T10:03:38","date_gmt":"2026-02-16T10:03:38","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/16\/critical-beyondtrust-vulnerability-exploited-in-the-wild-to-gain-full-domain-control\/"},"modified":"2026-02-16T10:03:38","modified_gmt":"2026-02-16T10:03:38","slug":"critical-beyondtrust-vulnerability-exploited-in-the-wild-to-gain-full-domain-control","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/16\/critical-beyondtrust-vulnerability-exploited-in-the-wild-to-gain-full-domain-control\/","title":{"rendered":"Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain Control"},"content":{"rendered":"

Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain Control
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical vulnerability tracked as\u00a0CVE-2026-1731 is being actively exploited in the wild, enabling attackers to gain\u00a0full domain control\u00a0over affected systems.<\/a><\/p>\n

Threat actors are leveraging this flaw to execute operating system commands remotely without authentication.<\/p>\n

The flaw, discovered in self-hosted BeyondTrust deployments, allows unauthenticated attackers to run arbitrary OS commands<\/a> via specially crafted HTTP requests, executing them under the site user\u2019s privileges.<\/p>\n

Cloud-ho<\/a>sted BeyondTrust instances<\/a> have already been automatically patched as of\u00a0February 2, 2026. However, self-hosted customers must apply updates manually to mitigate exploitation risks.<\/p>\n

Technical Details<\/strong><\/h2>\n

Arctic Wolf\u2019s analysis revealed attackers deploying\u00a0SimpleHelp Remote Access\u00a0binaries as part of their post-exploitation activity.<\/p>\n

\n\n\n\n\n\n
CVE ID<\/th>\nCVSS Score<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
CVE-2026-1731<\/strong><\/td>\n9.8 (Critical)<\/td>\nUnauthenticated OS command injection in BeyondTrust RS and PRA enabling remote code execution and full system compromise.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

These binaries were created through BeyondTrust Bomgar processes running under the SYSTEM account<\/a> and saved in the\u00a0ProgramData\u00a0directory, commonly named\u00a0remote access.exe<\/em>.<\/p>\n

The attackers used\u00a0net user\u00a0and\u00a0net group\u00a0commands to create privileged domain accounts, effectively granting themselves\u00a0Enterprise Admin\u00a0or\u00a0Domain Admin\u00a0rights.<\/p>\n

For reconnaissance, the\u00a0AdsiSearcher\u00a0function was executed to enumerate Active Directory computers<\/a>, alongside network discovery commands such as\u00a0net share,\u00a0ipconfig \/all, and\u00a0systeminfo.<\/p>\n

\n\n\n\n\n\n\n
Product<\/th>\nAffected Versions<\/th>\nFixed Versions<\/th>\n<\/tr>\n<\/thead>\n
Remote Support (RS)<\/strong><\/td>\n25.3.1 and prior<\/td>\nPatch BT26-02-RS (v21.3\u201325.3.1)<\/td>\n<\/tr>\n
Privileged Remote Access (PRA)<\/strong><\/td>\n24.3.4 and prior<\/td>\nPatch BT26-02-PRA (v22.1\u201324.X)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Arctic Wolf investigators noted<\/a> the use of\u00a0PSExec\u00a0and\u00a0Impacket SMBv2 session setup requests, suggesting coordinated propagation of the SimpleHelp tool across multiple networked hosts.<\/p>\n

Security experts strongly advise patching all vulnerable versions immediately. All\u00a0cloud-based\u00a0BeyondTrust customers are already protected.<\/p>\n

CISA advises<\/a> that self-hosted deployments running versions older than RS 21.3 or PRA 22.1 must first be upgraded before applying the patch.<\/p>\n

Administrators should review systems for unauthorized\u00a0SimpleHelp<\/em> binaries, suspicious admin accounts, and unusual network traffic<\/a> related to SMB sessions.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain Control<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain Control A critical vulnerability tracked as\u00a0CVE-2026-1731 is being actively exploited in the wild, enabling attackers to gain\u00a0full domain control\u00a0over affected systems. Threat actors are leveraging this flaw to execute operating system commands remotely without authentication. The flaw, discovered in self-hosted BeyondTrust deployments, allows unauthenticated […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,2169,131],"tags":[130],"class_list":["post-10683","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-exploit","category-vulnerability","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10683"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10683"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10683\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}