{"schema":"vulnpedia.research/1","cve":"CVE-2026-1731","references":[{"url":"https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293","tags":["Permissions Required"],"source":"mitre","sourceId":"BT","modified":"2026-02-06T21:49:20.844Z","origins":[{"source":"mitre","sourceId":"BT","modified":"2026-02-06T21:49:20.844Z","url":"https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293"},{"source":"nvd","sourceId":"CVE-2026-1731","modified":"2026-06-17T10:16:24.797","url":"https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293"}]},{"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-02","tags":["Vendor Advisory"],"source":"mitre","sourceId":"BT","modified":"2026-02-06T21:49:20.844Z","origins":[{"source":"mitre","sourceId":"BT","modified":"2026-02-06T21:49:20.844Z","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"},{"source":"nvd","sourceId":"CVE-2026-1731","modified":"2026-06-17T10:16:24.797","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"}]},{"url":"https://github.com/win3zz/CVE-2026-1731","tags":["exploit","Exploit","Third Party Advisory"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T15:04:15.451Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T15:04:15.451Z","url":"https://github.com/win3zz/CVE-2026-1731"},{"source":"nvd","sourceId":"CVE-2026-1731","modified":"2026-06-17T10:16:24.797","url":"https://github.com/win3zz/CVE-2026-1731"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T15:04:15.451Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T15:04:15.451Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731"},{"source":"nvd","sourceId":"CVE-2026-1731","modified":"2026-06-17T10:16:24.797","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731"}]},{"url":"https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731","tags":["third-party-advisory","Third Party Advisory"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T15:04:15.451Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T15:04:15.451Z","url":"https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731"},{"source":"nvd","sourceId":"CVE-2026-1731","modified":"2026-06-17T10:16:24.797","url":"https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731"}]},{"source":"euvd","sourceId":"EUVD-2026-5559","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5559","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-5559","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5559"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://arcticwolf.com/resources/blog/cve-2026-1731/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://arcticwolf.com/resources/blog/cve-2026-1731/"}]},{"url":"https://x.com/DefusedCyber/status/2022044978697125892","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://x.com/DefusedCyber/status/2022044978697125892"}]},{"url":"https://x.com/ethicalhack3r/status/2021870311377879136","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://x.com/ethicalhack3r/status/2021870311377879136"}]},{"url":"https://arcticwolf.com/resources/blog/update-arctic-wolf-observes-threat-campaign-targeting-beyondtrust-remote-support-following-cve-2026-1731-poc-availability/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://arcticwolf.com/resources/blog/update-arctic-wolf-observes-threat-campaign-targeting-beyondtrust-remote-support-following-cve-2026-1731-poc-availability/"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/"}]},{"url":"https://www.labs.greynoise.io/grimoire/2026-02-20-weekly-oast-report/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.labs.greynoise.io/grimoire/2026-02-20-weekly-oast-report/"}]},{"url":"https://ctrlaltintel.com/threat%20research/MuddyWater/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://ctrlaltintel.com/threat%20research/MuddyWater/"}]},{"url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape"}]},{"url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab"}]},{"url":"https://tracker.crowdsec.net/cves/CVE-2026-1731","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://tracker.crowdsec.net/cves/CVE-2026-1731"}]},{"url":"https://fortiguard.fortinet.com/outbreak-alert/iran-linked-cyber-attacks","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://fortiguard.fortinet.com/outbreak-alert/iran-linked-cyber-attacks"}]},{"url":"https://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-december-2025-february-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-december-2025-february-2026/"}]},{"url":"https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/"}]},{"url":"https://www.cyfirma.com/research/tracking-ransomware-march-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.cyfirma.com/research/tracking-ransomware-march-2026/"}]},{"url":"https://www.huntress.com/blog/uptick-bomgar-exploitation","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.huntress.com/blog/uptick-bomgar-exploitation"}]},{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q1-2026/119733/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://securelist.com/vulnerabilities-and-exploits-in-q1-2026/119733/"}]},{"url":"https://www.sysdig.com/content/c/2026-report-cloud-native-security-and-usage?x=riXUYg","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.sysdig.com/content/c/2026-report-cloud-native-security-and-usage?x=riXUYg"}]},{"url":"https://www.halcyon.ai/ransomware-evolution-report/q1-2026","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.halcyon.ai/ransomware-evolution-report/q1-2026"}]},{"url":"https://hs-24091716.f.hubspotemail.net/hubfs/24091716/UltraViolet-2026-TIDE-Q2-Threat-Review-1.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://hs-24091716.f.hubspotemail.net/hubfs/24091716/UltraViolet-2026-TIDE-Q2-Threat-Review-1.pdf"}]},{"url":"https://view.bitsight.com/viewer/275c18689811d887dfa0368866323ed5#1","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://view.bitsight.com/viewer/275c18689811d887dfa0368866323ed5#1"}]},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"url":"https://media.defense.gov/2026/Aug/26/2003986916/-1/-1/0/JCSA_CHINA_QTFY_MALICIOUS_SYSTEMS.PDF","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://media.defense.gov/2026/Aug/26/2003986916/-1/-1/0/JCSA_CHINA_QTFY_MALICIOUS_SYSTEMS.PDF"}]},{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/"}]},{"url":"https://www.f5.com/labs/articles/weekly-threat-bulletin-september-2nd-2026","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://www.f5.com/labs/articles/weekly-threat-bulletin-september-2nd-2026"}]},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era/"}]},{"url":"https://vulncheck.com/xdb/20609461cfeb","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"20609461cfeb","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"20609461cfeb","modified":"2026-02-09T00:00:00Z","url":"https://vulncheck.com/xdb/20609461cfeb"}]},{"url":"https://github.com/jakubie07/CVE-2026-1731","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"20609461cfeb","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"20609461cfeb","modified":"2026-02-09T00:00:00Z","url":"https://github.com/jakubie07/CVE-2026-1731"}]},{"url":"https://vulncheck.com/xdb/c3b30a556cb7","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"c3b30a556cb7","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"c3b30a556cb7","modified":"2026-02-09T00:00:00Z","url":"https://vulncheck.com/xdb/c3b30a556cb7"}]},{"url":"https://github.com/zensheII/CVE-2026-1731-PoC","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"c3b30a556cb7","modified":"2026-02-09T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"c3b30a556cb7","modified":"2026-02-09T00:00:00Z","url":"https://github.com/zensheII/CVE-2026-1731-PoC"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/win3zz/CVE-2026-1731","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"CVE-2026-1731 - Critical command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access due to unsafe Bash arithmetic evaluation in a WebSocket-reachable script","modified":"2026-10-05T01:21:04Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/win3zz/CVE-2026-1731"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-10-05T01:21:04Z","url":"https://github.com/win3zz/CVE-2026-1731"}],"tags":[]},{"url":"https://github.com/cybrdude/cve-2026-1731-scanner","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"Passive vulnerability scanner for CVE-2026-1731 — BeyondTrust RS/PRA pre-auth RCE (CVSS 9.9). Educational & defensive use only.","modified":"2026-08-24T14:53:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/cybrdude/cve-2026-1731-scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-08-24T14:53:05Z","url":"https://github.com/cybrdude/cve-2026-1731-scanner"}],"tags":[]},{"url":"https://github.com/jakubie07/CVE-2026-1731","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"CVE-2026-1731 PoC","modified":"2026-06-25T01:51:12Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/jakubie07/CVE-2026-1731"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-06-25T01:51:12Z","url":"https://github.com/jakubie07/CVE-2026-1731"}],"tags":[]},{"url":"https://github.com/hex0user/CVE-2026-1731","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"CVE-2026-1731 — BeyondTrust Remote Code Execution Vulnerability","modified":"2026-09-23T18:03:54Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/hex0user/CVE-2026-1731"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-09-23T18:03:54Z","url":"https://github.com/hex0user/CVE-2026-1731"}],"tags":[]},{"url":"https://github.com/ridhinva/beyondtrust-rce-scanner","source":"poc-in-github","sourceId":"CVE-2026-1731","description":"Scanner: CVE-2026-1731 BeyondTrust Remote Support Pre-auth RCE — Python checker for actively exploited vulnerability (CISA KEV)","modified":"2026-08-07T20:36:42Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-1731","url":"https://github.com/ridhinva/beyondtrust-rce-scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-1731","modified":"2026-08-07T20:36:42Z","url":"https://github.com/ridhinva/beyondtrust-rce-scanner"}],"tags":[]}],"cataloguedPoc":[{"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb","source":"metasploit","sourceId":"exploit/linux/http/beyondtrust_pra_rs_command_injection","description":"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution","modified":"2026-03-03 15:42:15 +0000","kind":"metasploit","verification":"catalogued","origins":[{"source":"metasploit","sourceId":"exploit/linux/http/beyondtrust_pra_rs_command_injection","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb"},{"source":"metasploit","sourceId":"exploit/linux/http/beyondtrust_pra_rs_command_injection","modified":"2026-03-03 15:42:15 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb"}],"tags":[]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"20609461cfeb","url":"https://vulncheck.com/xdb/20609461cfeb","cve":"CVE-2026-1731","dateAdded":"2026-02-18T06:05:46Z","modified":"2026-02-09T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/jakubie07/CVE-2026-1731","observations":[{"dateAdded":"2026-02-18T06:05:46Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"20609461cfeb","modified":"2026-02-09T00:00:00Z","url":"https://vulncheck.com/xdb/20609461cfeb"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"c3b30a556cb7","url":"https://vulncheck.com/xdb/c3b30a556cb7","cve":"CVE-2026-1731","dateAdded":"2026-03-23T16:51:16Z","modified":"2026-02-09T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/zensheII/CVE-2026-1731-PoC","observations":[{"dateAdded":"2026-03-23T16:51:16Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"c3b30a556cb7","modified":"2026-02-09T00:00:00Z","url":"https://vulncheck.com/xdb/c3b30a556cb7"}]}],"vendorStatements":[],"exploitationSources":[{"source":"euvd","sourceId":"EUVD-2026-5559","catalog":"ENISA EU KEV","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5559","dateAdded":"2026-02-13","origins":[{"source":"euvd","sourceId":"EUVD-2026-5559","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5559"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-02-09T00:00:00Z","modified":"2026-02-09T00:00:00Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known","reportedByVulncheckCanaries":false,"vendorProject":"BeyondTrust","product":"Remote Support (RS) and Privileged Remote Access (PRA)","dueDate":"2026-02-16T00:00:00Z","cisaDateAdded":"2026-02-13T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","modified":"2026-02-09T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://arcticwolf.com/resources/blog/cve-2026-1731/","dateAdded":"2026-02-09T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://arcticwolf.com/resources/blog/cve-2026-1731/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://x.com/DefusedCyber/status/2022044978697125892","dateAdded":"2026-02-12T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://x.com/DefusedCyber/status/2022044978697125892"},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://x.com/ethicalhack3r/status/2021870311377879136"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://arcticwolf.com/resources/blog/update-arctic-wolf-observes-threat-campaign-targeting-beyondtrust-remote-support-following-cve-2026-1731-poc-availability/","dateAdded":"2026-02-13T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://arcticwolf.com/resources/blog/update-arctic-wolf-observes-threat-campaign-targeting-beyondtrust-remote-support-following-cve-2026-1731-poc-availability/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/","dateAdded":"2026-02-19T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.labs.greynoise.io/grimoire/2026-02-20-weekly-oast-report/","dateAdded":"2026-02-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.labs.greynoise.io/grimoire/2026-02-20-weekly-oast-report/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://ctrlaltintel.com/threat%20research/MuddyWater/","dateAdded":"2026-03-04T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://ctrlaltintel.com/threat%20research/MuddyWater/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape","dateAdded":"2026-03-12T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab","dateAdded":"2026-03-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab"},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://tracker.crowdsec.net/cves/CVE-2026-1731"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://fortiguard.fortinet.com/outbreak-alert/iran-linked-cyber-attacks","dateAdded":"2026-03-31T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://fortiguard.fortinet.com/outbreak-alert/iran-linked-cyber-attacks"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-december-2025-february-2026/","dateAdded":"2026-04-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-december-2025-february-2026/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/","dateAdded":"2026-04-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cyfirma.com/research/tracking-ransomware-march-2026/","dateAdded":"2026-04-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.cyfirma.com/research/tracking-ransomware-march-2026/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.huntress.com/blog/uptick-bomgar-exploitation","dateAdded":"2026-04-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.huntress.com/blog/uptick-bomgar-exploitation"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://securelist.com/vulnerabilities-and-exploits-in-q1-2026/119733/","dateAdded":"2026-05-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://securelist.com/vulnerabilities-and-exploits-in-q1-2026/119733/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.sysdig.com/content/c/2026-report-cloud-native-security-and-usage?x=riXUYg","dateAdded":"2026-06-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.sysdig.com/content/c/2026-report-cloud-native-security-and-usage?x=riXUYg"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.halcyon.ai/ransomware-evolution-report/q1-2026","dateAdded":"2026-06-11T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.halcyon.ai/ransomware-evolution-report/q1-2026"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://hs-24091716.f.hubspotemail.net/hubfs/24091716/UltraViolet-2026-TIDE-Q2-Threat-Review-1.pdf","dateAdded":"2026-06-15T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://hs-24091716.f.hubspotemail.net/hubfs/24091716/UltraViolet-2026-TIDE-Q2-Threat-Review-1.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://view.bitsight.com/viewer/275c18689811d887dfa0368866323ed5#1","dateAdded":"2026-06-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://view.bitsight.com/viewer/275c18689811d887dfa0368866323ed5#1"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a","dateAdded":"2026-08-18T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://media.defense.gov/2026/Aug/26/2003986916/-1/-1/0/JCSA_CHINA_QTFY_MALICIOUS_SYSTEMS.PDF","dateAdded":"2026-08-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://media.defense.gov/2026/Aug/26/2003986916/-1/-1/0/JCSA_CHINA_QTFY_MALICIOUS_SYSTEMS.PDF"},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://www.f5.com/labs/articles/weekly-threat-bulletin-september-2nd-2026","dateAdded":"2026-09-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://www.f5.com/labs/articles/weekly-threat-bulletin-september-2nd-2026"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","catalog":"VulnCheck KEV","kind":"report","url":"https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era/","dateAdded":"2026-09-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-1731","url":"https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era/"}]}]}