Feds told to patch BeyondTrust flaw within 3 days after active exploitation
TL;DR
CISA ordered Federal civilian agencies to patch BeyondTrust Remote Support and Privileged Remote Access within three days after CVE-2026-1731, a remote code execution flaw that’s been actively exploited. SaaS instances were patched by BeyondTrust on Feb 2, 2026, but on-premise deployments require manual updates. Exploitation can allow unauthenticated remote code execution, risking system compromise, data exfiltration, and service disruption. Threat intel reports active exploitation and about 11,000 exposed instances (roughly 8,500 on‑premises). The agency added the CVE to its Known Exploited Vulnerabilities catalog and urged mitigations or discontinuation per vendor guidance under BOD 22-01.
Topics:businesstechnology#beyondtrust#cybersecurity#government#patch-management#technology#vulnerability
- CISA gives feds 3 days to patch actively exploited BeyondTrust flaw BleepingComputer
- Update: Arctic Wolf Observes Threat Campaign Targeting BeyondTrust Remote Support Following CVE-2026-1731 PoC Availability Arctic Wolf
- Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability The Hacker News
- Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far GreyNoise Intelligence
- BeyondTrust RCE Exploited for Domain Control eSecurity Planet
Want the full story? Read the original reporting
Read on BleepingComputer