CVE-2026-1731: Pre-auth command injection in BeyondTrust Remote Support

What it is

BeyondTrust Remote Support (formerly Bomgar) and older Privileged Remote Access appliances accept client connections over a WebSocket at /nw. During the handshake, the client sends a remoteVersion value, which a shell script on the appliance, thin-scc-wrapper, compares in a bash arithmetic expression. Bash evaluates command substitutions such as $(...) inside those expressions, so a crafted version string runs commands on the appliance. No login and no user interaction.

Commands run as the appliance’s “site user”, not root. Unit 42 notes that this still gives control over the appliance’s configuration, the support sessions it brokers and their traffic. For a tool whose job is remote access into your endpoints, that’s a lot.

It is a variant of CVE-2024-12356, the same WebSocket path and the same parameter, which Silk Typhoon used against the U.S. Treasury in 2024. An earlier fix added input checks that, per Unit 42, were not complete.

Exploitation started within a day of a public proof of concept on February 10. Attackers used it to plant web shells and backdoors, create domain admin accounts, move laterally and steal data, and CISA has flagged it as used in ransomware attacks.

Am I affected?

You’re affected if you run a self-hosted (on-premises or your own cloud VM) appliance on:

• Remote Support 25.3.1 or earlier, or
• Privileged Remote Access 24.3.4 or earlier,

and the BT26-02 patch has not been applied. Internet-facing appliances are the ones being attacked. BeyondTrust says observed exploitation was limited to internet-facing, self-hosted appliances still unpatched on February 9, 2026.

SaaS instances of both products were patched by BeyondTrust on 2 February 2026. Privileged Remote Access 25.1 and later is not affected.

Appliances subscribed to automatic updates in the /appliance interface received the patch on 2 February. Check that interface to confirm your version and whether BT26-02 is installed. If it is missing, you are exposed.

What to do

1. Patch or upgrade now.

• Remote Support 21.3 to 25.3.1: apply BT26-02-RS, or upgrade to 25.3.2 or later.
• Privileged Remote Access 22.1 to 24.x: apply BT26-02-PRA, or upgrade to 25.1.1 or later.
• Remote Support older than 21.3 or PRA older than 22.1: the patch doesn’t apply. Upgrade to a supported version first, then patch.

2. Turn on automatic updates in the /appliance interface, if your change process allows it. That’s how most appliances got this fix before the advisory was public.

3. If the appliance was internet-facing and unpatched on or after February 9, 2026, assume compromise. BeyondTrust asks these customers to open a Severity 1 support ticket citing BT26-02. Then:

• Hunt on the appliance and on every endpoint it can reach (Detection, below). Attackers ran commands on Windows hosts through the BeyondTrust client process there (bomgar-scc.exe).
• Remove accounts you didn’t create, in the appliance and in Active Directory. Arctic Wolf saw attackers add new users to Domain Admins and Enterprise Admins.
• Rotate credentials stored in or brokered through the appliance, including any Vault entries and service accounts.
• Look for web shells and a modified Apache setup on the appliance. Unit 42 saw a dropper that restored a clean config file on disk while the malicious config stayed loaded, so a file-level check alone is not enough. Work with BeyondTrust support on whether to rebuild.

Detection

On the appliance and at the network edge:

• WebSocket connections to /nw from unknown addresses, with an X-Ns-Company header and the subprotocol ingredi support desk customer thin (Rapid7). Requests to get_portal_info just before, which attackers used to read the company name (watchTowr, via Help Net Security).
• A remoteVersion value that contains $(, backticks or the pattern a[$(cmd)]0 from the proof of concept (Unit 42). On a patched appliance, attempts produce the log line ERROR: Invalid remote version - must be a 1-2 digit number (Rapid7).
• Outbound DNS lookups or connections from the appliance to OAST services (oast.pro, oast.fun, oastify.com). Attackers used them to confirm code execution, sending the hex-encoded hostname as a subdomain.
• New PHP files in the web root, such as aws.php, file_save.php or maintenance.php, and one-line PHP shells keyed on a GET parameter (aaaa) or a query key (vjwr) (Unit 42).
• Downloads with wget, curl, python or busybox chained together, a script named blue.drx, ligolo-ng tunnel agents, or reverse shells on port 4444.
• A full PostgreSQL dump or archives of configuration files staged for upload.
• Unit 42 also saw a Python script that briefly replaced the admin (user ID 1) password hash for 60 seconds, then restored it. Review admin logins around any suspicious activity, even if the password still works.

On Windows endpoints reached through the appliance:

• cmd.exe or powershell.exe started by bomgar-scc.exe and running net user ... /add /domain, net group "domain admins" ..., whoami, nltest, systeminfo, ipconfig /all or AD queries such as [adsiSearcher]"(ObjectClass=computer)" (Unit 42, Arctic Wolf).
• Renamed SimpleHelp binaries such as remote access.exe in the root of C:\ProgramData, created by Bomgar processes as SYSTEM, with the file description “SimpleHelp Remote Access Client”. Also look for AnyDesk, Nezha agents and Cloudflare tunnels you didn’t install.
• PsExec pushing installers to many hosts, and Impacket SMB sessions early in the intrusion.