Critical BeyondTrust RCE: How CybrPulse Gave Security Teams 3 Days Before Active Exploitation

When BeyondTrust disclosed CVE-2026-1731 on February 6, 2026, most security teams had no idea they were sitting on a ticking time bomb. This critical remote code execution vulnerability, with a CVSS score of 9.9, gave attackers everything they needed to strike within days. The question wasn't if, but when.

CybrPulse detected the threat on February 7 at 08:55 UTC. By the time major security outlets picked up the story on February 9, and certainly before the proof of concept dropped on GitHub on February 10, our customers had already had days to patch their systems.

That early warning made all the difference.

What Happened

CVE-2026-1731 is a pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and older versions of Privileged Remote Access. An unauthenticated attacker can send specially crafted requests to vulnerable systems and execute arbitrary operating system commands without logging in, without any user interaction, and without needing any credentials.

The vulnerability is as severe as it gets. Successful exploitation leads to complete system compromise, unauthorized access, data theft, and service disruption. And because BeyondTrust products manage privileged access to enterprise infrastructure, compromising these systems gives attackers the keys to the kingdom.

According to Hacktron researchers, approximately 11,000 BeyondTrust Remote Support instances sat exposed online when BeyondTrust disclosed the vulnerability. Around 8,500 of those ran on premises, vulnerable to attack if not patched immediately. Large organizations in healthcare, financial services, government, and hospitality sectors were among the affected.

The Timeline That Matters

Here's how it unfolded:

February 6, 2026: BeyondTrust privately discloses the vulnerability and releases patches. Cloud/SaaS customers are automatically patched starting February 2. Self-hosted customers need to apply BT26-02-RS or BT26-02-PRA patches immediately.

February 7, 2026 at 08:55 UTC: CybrPulse ingests the first public report from CybersecurityNews at 08:34 UTC, giving our customers immediate visibility into the threat.

February 9, 2026: Major security outlets including BleepingComputer, The Hacker News, GBHackers, and SecurityWeek begin widespread coverage. At this point, CybrPulse customers have had 46 hours of advance notice.

February 10, 2026: Researchers publish a proof of concept exploit on GitHub. Security teams now have working exploit code to study. CybrPulse customers have had 3 days to patch before attackers have easy access to weaponized code.

February 11, 2026: Active exploitation begins. GreyNoise detects reconnaissance activity within 24 hours of the PoC release. A single IP address is responsible for 86% of the scanning activity, probing non-standard ports and showing sophisticated knowledge of how enterprises deploy BeyondTrust. CybrPulse customers who acted on our alert have had 4 days to secure their systems before attackers started hunting.

February 14, 2026: CISA adds CVE-2026-1731 to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch by February 16. At this point, the threat is undeniable and mandatory for government systems. CybrPulse gave our customers a 7-day head start on this deadline.

How CybrPulse Detected It

Our platform continuously monitors hundreds of security information sources, including specialized cybersecurity news outlets, vendor advisories, researcher blogs, and community forums. When CybersecurityNews published their analysis of CVE-2026-1731 on February 7 at 08:34 UTC, our system ingested and analyzed the article within 21 minutes.

Our AI analysis engine immediately flagged the threat with a priority score of 19, identifying it as a critical incident requiring immediate attention. The system extracted key technical details including the CVSS score of 9.9, the affected BeyondTrust products, the attack vector (unauthenticated remote code execution), and the patch information.

While mainstream security outlets were still preparing their coverage, CybrPulse had already aggregated reports from multiple sources, correlated the technical details, and delivered actionable intelligence to our customers. By the time The Hacker News and BleepingComputer published on February 9, we had already tracked the story for nearly two days.

The Attack Surface

What makes this vulnerability particularly dangerous is the targeting precision shown by attackers. GreyNoise observed that threat actors were probing non-standard ports, not just the default port 443. This indicates the attackers understood that enterprises move BeyondTrust services off standard ports as a basic security measure.

The reconnaissance infrastructure these attackers used wasn't single purpose either. The same IP addresses scanning for CVE-2026-1731 also targeted SonicWall, MOVEit Transfer, Log4j, Sophos firewalls, SSH services, and IoT devices with default credentials. Some attackers used out-of-band callback domains, a more sophisticated technique to confirm vulnerability before delivering payloads.

This is coordinated, professional threat actor behavior. The kind that moves fast and exploits windows of opportunity measured in hours, not days.

What You Need to Know

If you run BeyondTrust Remote Support or Privileged Remote Access on-premises, you need to patch immediately. Apply BT26-02-RS or BT26-02-PRA, or upgrade to Remote Support version 25.3.2 or Privileged Remote Access version 25.1.1.

If you haven't patched yet, assume you may be compromised. Look for:

• Unusual command execution in BeyondTrust logs
• Reconnaissance activity on both standard port 443 and non-standard ports where BeyondTrust services are deployed
• Lateral movement from BeyondTrust systems to other infrastructure
• Unauthorized access to privileged accounts managed through BeyondTrust
• Network connections to unknown external domains from BeyondTrust servers

Audit your BeyondTrust deployments for any signs of unauthorized access since February 6. Review which systems have privileged access through BeyondTrust and check those for compromise as well.

If you moved BeyondTrust services to non-standard ports thinking that would protect you, understand that attackers are specifically scanning for that. Port obscurity is not a security control. Patching is.

The Bigger Picture

CVE-2026-1731 is a case study in how fast modern vulnerability exploitation timelines have become. From disclosure to patch to public PoC to active exploitation took less than a week. The window between "threat discovered" and "threat weaponized" is compressing to the point where days matter.

For organizations relying on traditional security intelligence sources, waiting for CISA to add a vulnerability to the KEV catalog or for your vendor to send an email blast means you're already behind. By the time those official channels activate, attackers are already in the wild.

The 46-hour gap between CybrPulse detection and mainstream security news coverage might not sound like much. But when exploitation begins 72 hours after a PoC is released, those 46 hours are the difference between patching before the attack and responding to an incident.

The multi exploit behavior in this campaign is also telling. Attackers aren't hunting for one vulnerability at a time. They're scanning for everything at once: BeyondTrust, SonicWall, Log4j, Sophos, SSH, IoT devices. They're portfolio managers of exploitation. The question isn't whether your organization has one vulnerable system. It's how many vulnerabilities you're exposed to at any given moment that you don't know about.

How CybrPulse Helps

This is exactly what CybrPulse was built for. We don't just aggregate security news. We monitor hundreds of sources simultaneously, analyze threats in real time, and deliver intelligence before it becomes common knowledge.

When CVE-2026-1731 was disclosed, our customers saw it on February 7. They had the technical details, the affected systems, the patch information, and the context they needed to prioritize the response. They had time to test patches, schedule maintenance windows, and deploy fixes before proof of concept code was publicly available.

By the time attackers started hunting on February 11, our customers had already closed the window.

That's the value of early warning. Not hypothetical. Not theoretical. Three days of advance notice before active exploitation. Seven days before the federal government mandated action.

In modern threat response, hours matter. CybrPulse gives you days.

If your security team is still relying on vendor emails, CISA announcements, and mainstream security news to stay informed, you're already behind. The threats are moving faster than that. Your intelligence needs to move faster too.

Want to see how early CybrPulse can detect threats relevant to your environment? Our platform continuously monitors the security landscape and delivers actionable intelligence before threats go mainstream. Learn more about CybrPulse.