A critical pre‑authentication remote code execution flaw in BeyondTrust’s Remote Support and Privileged Remote Access allows unauthenticated attackers to run arbitrary commands on exposed appliances, enabling full system compromise and broad lateral movement.
Cyber News Centre's cyber update for 17th February 2026: A critical remote code execution vulnerability in BeyondTrust's privileged access management products is under active exploitation, prompting an emergency directive from the US cybersecurity agency CISA.
BeyondTrust, a global provider of identity and access security solutions for 20,000 customers including 75% of the Fortune 100, develops widely used tools for privileged access management (PAM). Its Remote Support and Privileged Remote Access products allow IT administrators to securely connect to and manage systems across an organisation.
Update: A critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-1731, is being actively exploited in BeyondTrust's Remote Support and Privileged Remote Access software. The flaw allows attackers to execute arbitrary code without authentication, potentially leading to complete system compromise.
The vulnerability was disclosed by BeyondTrust on February 6, and a proof-of-concept exploit was made public on February 10. Within 24 hours, security researchers at GreyNoise, watchTowr, and Arctic Wolf observed widespread scanning and active exploitation attempts.
Attackers are reportedly using the flaw to deploy the SimpleHelp remote management tool for persistent access and are performing lateral movement within compromised networks. In response to the active threat, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 16 and issued a binding operational directive ordering US federal agencies to patch the flaw by the end of the day. The directive underscores the severity of the threat to government and enterprise networks globally.
Why it Matters: The rapid exploitation of this BeyondTrust vulnerability highlights the shrinking window for defenders to patch critical systems. For Australian organisations, many of which rely on BeyondTrust for managing privileged access to sensitive networks and critical infrastructure, this incident is a major security risk. A compromise of these systems provides a direct path for attackers to gain deep access into corporate networks, bypass security controls, and exfiltrate sensitive data.
The CISA directive, while only mandatory for US federal agencies, serves as a strong warning for Australian businesses to prioritise patching immediately. The use of this vulnerability to deploy additional remote access tools demonstrates a sophisticated attack chain aimed at establishing long-term persistence, making detection and remediation significantly more challenging. This incident reinforces the critical importance of robust vulnerability management programs and the need for rapid response capabilities when high-impact flaws are actively exploited in the wild.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
OpenAI flew its chief strategy officer to Sydney to apologise for a rogue AI agent's Medicare breach. The hack was clumsy. The silence that followed was worse, and Parliament now has to decide whether sorry is the only accountability on offer.
OpenAI’s Medicare breach has shifted Australia’s AI debate from investment to accountability. As Canberra examines legal options and calls grow for stronger sovereign capability, the question is global: who controls autonomous systems, and who answers when they cross national boundaries?
OpenAI's Astra can develop zero-day exploits, while a US$1 billion defence push seeks to give critical infrastructure teams the same machine-speed advantage.
The AI race is moving beyond model rankings. CrowdStrike’s new cyber superintelligence lab points to a market where proprietary data, trusted workflows and measurable outcomes may matter as much as raw capability.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
