CISA Gives Feds 3 Days to Patch Actively Exploited BeyondTrust Flaw

CISA gives feds 3 days to patch actively exploited BeyondTrust flaw

CISA ordered U.S. government agencies on Friday to secure their BeyondTrust Remote Support instances against an actively exploited vulnerability within three days.

BeyondTrust RCE Exploited for Domain Control

Attackers are actively exploiting a vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) to remotely run commands and escalate to full domain control in some environments.  The flaw affects self-hosted deployments and can be triggered without authentication. We “… observed attempts to deploy the SimpleHelp RMM tool for persistence, along with discovery and lateral movement activities,” said Arctic Wolf researchers.…

Attackers Exploit Critical BeyondTrust Flaw to Seize Full Active Directory Control - Cybernoz - Cybersecurity News

A critical vulnerability, CVE-2026-1731, affecting self-hosted BeyondTrust Remote Support and Privileged Remote Access deployments. This security flaw allows unauthenticated attackers to inject operating system commands, effectively granting them remote code execution capabilities. The severity of this campaign has prompted the Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) ca…

Active exploitation seen in BeyondTrust access flaw

Arctic Wolf says attackers are actively exploiting a critical BeyondTrust vulnerability in self-hosted remote access systems.

Legacy BeyondTrust Appliances Under Siege: How End-of-Life Remote Support Systems Became a Gateway for Active Exploitation

A critical vulnerability in BeyondTrust’s Remote Support (RS) product line — formerly known as Bomgar — is being actively exploited in the wild, exposing organizations that have failed to retire or patch aging remote access appliances to serious risk. The attacks, which security researchers have been tracking in recent weeks, underscore the persistent danger posed by legacy infrastructure that lingers in enterprise environments long after vendor…