17th February 2026 Cyber Update: BeyondTrust Flaw Under Active Attack, CISA Issues Urgent Patch Order

Cyber News Centre's cyber update for 17th February 2026: A critical remote code execution vulnerability in BeyondTrust's privileged access management products is under active exploitation, prompting an emergency directive from the US cybersecurity agency CISA.

BeyondTrust, a global provider of identity and access security solutions for 20,000 customers including 75% of the Fortune 100, develops widely used tools for privileged access management (PAM). Its Remote Support and Privileged Remote Access products allow IT administrators to securely connect to and manage systems across an organisation.

The Update and Why It Matters

Update: A critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-1731, is being actively exploited in BeyondTrust's Remote Support and Privileged Remote Access software. The flaw allows attackers to execute arbitrary code without authentication, potentially leading to complete system compromise.

The vulnerability was disclosed by BeyondTrust on February 6, and a proof-of-concept exploit was made public on February 10. Within 24 hours, security researchers at GreyNoise, watchTowr, and Arctic Wolf observed widespread scanning and active exploitation attempts.

Attackers are reportedly using the flaw to deploy the SimpleHelp remote management tool for persistent access and are performing lateral movement within compromised networks. In response to the active threat, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 16 and issued a binding operational directive ordering US federal agencies to patch the flaw by the end of the day. The directive underscores the severity of the threat to government and enterprise networks globally.

Why it Matters: The rapid exploitation of this BeyondTrust vulnerability highlights the shrinking window for defenders to patch critical systems. For Australian organisations, many of which rely on BeyondTrust for managing privileged access to sensitive networks and critical infrastructure, this incident is a major security risk. A compromise of these systems provides a direct path for attackers to gain deep access into corporate networks, bypass security controls, and exfiltrate sensitive data.

The CISA directive, while only mandatory for US federal agencies, serves as a strong warning for Australian businesses to prioritise patching immediately. The use of this vulnerability to deploy additional remote access tools demonstrates a sophisticated attack chain aimed at establishing long-term persistence, making detection and remediation significantly more challenging. This incident reinforces the critical importance of robust vulnerability management programs and the need for rapid response capabilities when high-impact flaws are actively exploited in the wild.

Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.