Critical · published February 6, 2026
CVSS calls it critical at 9.9. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 A critical pre-authentication RCE vulnerability lets attackers execute commands without even logging in! 🔥 Think of this vulnerability like a hotel with an open side entrance where anyone can stroll in without a keycard — they could access your room and do whatever they want. It's a surprisingly sneaky flaw allowing unauthorized access right into the heart of your system. An attacker could theoretically walk right in and take control of your entire system, potentially stealing sensitive data, installing malware, or causing major disruptions. This is absolutely devastating, especially since they don’t need any credentials to do it!
Think of this vulnerability like a hotel with an open side entrance where anyone can stroll in without a keycard — they could access your room and do whatever they want. It's a surprisingly sneaky flaw allowing unauthorized access right into the heart of your system. This vulnerability in BeyondTrust Remote Support and older versions of Privileged Remote Access allows attackers to send specially crafted requests that can execute arbitrary operating system commands as if they were the site user, creating a massive security risk.
An attacker could theoretically walk right in and take control of your entire system, potentially stealing sensitive data, installing malware, or causing major disruptions. This is absolutely devastating, especially since they don’t need any credentials to do it! Immediate action is necessary! Upgrade to the latest version of BeyondTrust Remote Support and Privileged Remote Access where the vulnerability is patched. Review your access controls and ensure that any unused services are disabled to limit exposure. 🛡️ You've got this! By taking these steps, you can secure your systems and keep the bad guys out! 💪✨