CISA Warns of BeyondTrust RCE Exploitation in Ransomware Attacks

Post Views: 7

Critical Vulnerability in BeyondTrust Software Added to CISA’s KEV Catalog

A critical vulnerability in BeyondTrust software has been added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) catalog of Known Exploited Vulnerabilities (KEV), after researchers confirmed it is being actively exploited in ransomware attacks.

Vulnerability Details

The vulnerability, identified as CVE-2026-1731, was patched by BeyondTrust on February 6, but its exploitation has only recently been confirmed. The bug carries a critical CVSS score of 9.9 and can be exploited by an unauthenticated attacker to achieve remote code execution (RCE) through specially-crafted requests.

“This is no longer just a vulnerability management issue, but an incident response situation,” said Douglas McKee, director of vulnerability intelligence at Rapid7. “The fact that CISA has confirmed ransomware actors are actively exploiting this flaw means that teams need to take immediate action to patch their systems.”

Risk and Mitigation

The vulnerability affects identity and privileged access infrastructure, making it particularly dangerous. If exploited, attackers can gain RCE across an organization’s environment, potentially inheriting elevated permissions and trust relationships.

In such a scenario, deploying ransomware becomes a matter of timing, rather than capability, according to McKee. To mitigate the risk, John Bambenek, president at Bambenek Consulting, recommends taking the BeyondTrust portal offline until patching can be completed, or restricting access to the appliance portal to internal IP addresses only.

Additionally, Bambenek suggests that web application firewalls (WAFs) can be used to inspect or block traffic to the portal’s /nw endpoint, as well as filter inappropriate bash commands in WebSocket calls.

Conclusion

The exploitation of this vulnerability highlights the importance of timely patching and vulnerability management. Organizations are advised to prioritize patching CVE-2026-1731 to prevent potential ransomware attacks.