{"schema":"vulnpedia.poc/1","cve":"CVE-2026-1731","generated":"2026-10-26T06:59:15.268Z","kev":{"since":"2026-02-13","ransomware":true},"epss":{"score":0.931,"percentile":0.99832},"cvss":{"version":"4.0","score":9.9,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L"},"has_public_poc":true,"poc_sources":[{"kind":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb","executable":true,"sourceId":"exploit/linux/http/beyondtrust_pra_rs_command_injection","description":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution","verification":"catalogued","source":"metasploit","modified":"2026-03-03 15:42:15 +0000","origins":[{"source":"metasploit","sourceId":"exploit/linux/http/beyondtrust_pra_rs_command_injection","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb"},{"source":"metasploit","sourceId":"exploit/linux/http/beyondtrust_pra_rs_command_injection","modified":"2026-03-03 15:42:15 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb"}]},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/20609461cfeb","executable":false,"sourceId":"20609461cfeb","verification":"catalogued","source":"vulncheck-kev","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"20609461cfeb","modified":"2026-02-09T00:00:00Z","url":"https://vulncheck.com/xdb/20609461cfeb"}],"repositoryUrl":"https://github.com/jakubie07/CVE-2026-1731"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/c3b30a556cb7","executable":false,"sourceId":"c3b30a556cb7","verification":"catalogued","source":"vulncheck-kev","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"c3b30a556cb7","modified":"2026-02-09T00:00:00Z","url":"https://vulncheck.com/xdb/c3b30a556cb7"}],"repositoryUrl":"https://github.com/zensheII/CVE-2026-1731-PoC"}],"poc_candidates":[{"url":"https://github.com/win3zz/CVE-2026-1731","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"CVE-2026-1731 - Critical command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access due to unsafe Bash arithmetic evaluation in a WebSocket-reachable script","modified":"2026-10-05T01:21:04Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/win3zz/CVE-2026-1731"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-10-05T01:21:04Z","url":"https://github.com/win3zz/CVE-2026-1731"}],"tags":[]},{"url":"https://github.com/cybrdude/cve-2026-1731-scanner","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"Passive vulnerability scanner for CVE-2026-1731 — BeyondTrust RS/PRA pre-auth RCE (CVSS 9.9). Educational & defensive use only.","modified":"2026-08-24T14:53:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/cybrdude/cve-2026-1731-scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-08-24T14:53:05Z","url":"https://github.com/cybrdude/cve-2026-1731-scanner"}],"tags":[]},{"url":"https://github.com/jakubie07/CVE-2026-1731","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"CVE-2026-1731 PoC","modified":"2026-06-25T01:51:12Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/jakubie07/CVE-2026-1731"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-06-25T01:51:12Z","url":"https://github.com/jakubie07/CVE-2026-1731"}],"tags":[]},{"url":"https://github.com/hex0user/CVE-2026-1731","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"CVE-2026-1731 — BeyondTrust Remote Code Execution Vulnerability","modified":"2026-09-23T18:03:54Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/hex0user/CVE-2026-1731"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-09-23T18:03:54Z","url":"https://github.com/hex0user/CVE-2026-1731"}],"tags":[]},{"url":"https://github.com/ridhinva/beyondtrust-rce-scanner","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"Scanner: CVE-2026-1731 BeyondTrust Remote Support Pre-auth RCE — Python checker for actively exploited vulnerability (CISA KEV)","modified":"2026-08-07T20:36:42Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/ridhinva/beyondtrust-rce-scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-08-07T20:36:42Z","url":"https://github.com/ridhinva/beyondtrust-rce-scanner"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2026-1731 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-1731/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[{"kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-1731.yaml","template":"javascript/cves/2026/CVE-2026-1731.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-1731%22&type=repositories","executable":false}]}