Attackers are actively exploiting a vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) to remotely run commands and escalate to full domain control in some environments.
The flaw affects self-hosted deployments and can be triggered without authentication.
We “… observed attempts to deploy the SimpleHelp RMM tool for persistence, along with discovery and lateral movement activities,” said Arctic Wolf researchers.
How CVE-2026-1731 Is Being Exploited
CVE-2026-1731 is an unauthenticated OS command injection vulnerability that allows remote code execution (RCE) through specially crafted HTTP requests sent to vulnerable self-hosted BeyondTrust appliances.
Arctic Wolf has confirmed active exploitation in the wild, with observed activity showing a clear progression from establishing persistence to enumerating Active Directory and ultimately escalating privileges to full domain control.
In observed incidents, attackers first leveraged the flaw to execute commands through Bomgar processes running under the SYSTEM account.
They then deployed the SimpleHelp remote monitoring and management (RMM) tool to maintain persistence.
Renamed SimpleHelp binaries were written to the ProgramData directory and executed locally.
File metadata identified the binaries as SimpleHelp Remote Access Client, signaling the use of legitimate administrative tooling for post-exploitation control.
After establishing persistence, attackers moved into reconnaissance.
Arctic Wolf documented the use of standard Windows discovery commands such as net share, ipconfig /all, and systeminfo to inventory network configuration and system details.
Active Directory enumeration was performed using the AdsiSearcher function to identify domain-joined computers and potential lateral movement targets.
Privilege escalation soon followed. Investigators observed attackers creating new domain accounts with the net user command and adding those accounts to high-privilege groups such as Domain Admins and Enterprise Admins using the net group command.
This effectively granted domain-wide administrative control. For lateral movement, the campaign leveraged PSExec to deploy SimpleHelp across additional hosts, along with Impacket SMBv2 session setup requests consistent with coordinated propagation across the network.
BeyondTrust confirmed that all cloud-hosted Remote Support (RS) and Privileged Remote Access (PRA) instances were automatically patched as of Feb. 2, 2026.
However, self-hosted customers must manually apply the appropriate updates, leaving unpatched environments exposed to this active exploitation campaign.
Reducing Risk from CVE-2026-1731
With exploitation activity observed, organizations should take steps to reduce exposure and evaluate potential exploitation impact.
- Patch impacted systems and validate remediation through authenticated vulnerability scans.
- Restrict and harden the management plane by limiting administrative interfaces to trusted networks, enforcing strong access controls, and removing unnecessary internet exposure.
- Perform threat hunting for indicators of compromise, including unauthorized SimpleHelp binaries, suspicious process execution under SYSTEM, unexpected domain account creation, and privileged group membership changes.
- Monitor and restrict lateral movement by alerting on PSExec usage, Impacket SMB activity, unusual SMB authentication patterns, and unauthorized RMM tool deployment.
- Strengthen identity protections by enforcing least privilege, implementing just-in-time admin access, rotating privileged credentials where compromise is suspected, and requiring phishing-resistant MFA for administrative roles.
- Enhance logging and visibility by enabling advanced Windows and PowerShell auditing, centralizing appliance logs into a SIEM or XDR platform, and correlating identity and network telemetry.
- Regularly test incident response plans through tabletop exercises that simulate domain compromise scenarios.
Collectively, these steps can help organizations lower immediate risk and build resilience.
The exploitation of CVE-2026-1731 underscores the operational risk posed by vulnerabilities in remote support and privileged access platforms, particularly in self-hosted deployments that rely on manual patch management.
Given these systems’ deep integration with Active Directory and core administrative workflows, a single weakness can provide a pathway from initial access to elevated domain privileges.
This risk is leading organizations to adopt zero-trust solutions that enforce continuous verification and reduce implicit trust across privileged access pathways.