flawopen.com/Teardowns/cve-2026-1731-beyondtrust-websocket-command-injection
CVE-2026-1731: BeyondTrust Command Injection
CVE-2026-1731 allows pre-auth OS commands via WebSocket in unpatched BeyondTrust Remote Support/PRA. Patch and investigate exposed systems.
Imagine a reception desk asking a visitor for a numeric version, then handing that answer to a calculator that evaluates formulas instead of checking digits. The visitor’s input can cross from data into instructions. CVE-2026-1731 let a remote peer reach that boundary in a BeyondTrust service; the fix rejects anything except a short decimal version before comparison.
Core Concepts & Subsystem Terms
CVE-2026-1731- A critical, unauthenticated OS command-injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access.
thin-scc-wrapper- A BeyondTrust shell wrapper used in a client protocol path. Rapid7’s patch analysis identifies its handling of a peer-supplied version as the vulnerable boundary.
Bash arithmetic evaluation- Bash numeric comparison operators evaluate operands as arithmetic expressions. Treating untrusted text as an operand can therefore cross a data-to-expression boundary.
CWE-78- Improper neutralization of special elements used in an OS command, commonly called OS command injection.
CISA KEV- The Known Exploited Vulnerabilities catalog records vulnerabilities that CISA says have evidence of exploitation in the wild.
Framework mappings
- CWE reference for the weakness described in this guide: CWE-78
- CISA KEV — added 2026-02-13 — CVE-2026-1731
Root Cause Analysis
BeyondTrust’s February 2026 advisory identifies CVE-2026-1731 as a pre-authentication remote code execution issue in Remote Support and Privileged Remote Access, assigns CWE-78 and CVSS 4.0 9.9, and says specially crafted client requests can execute OS commands in the site-user context. Rapid7’s analysis of the vendor patch narrows the source-level boundary to the thin-scc-wrapper WebSocket path: the script reads a peer-controlled remoteVersion and compares it with Bash numeric operators. In Bash, those comparisons perform arithmetic evaluation; a value that is not a plain number can be interpreted as an expression rather than inert text. The vendor patch adds a check requiring one or two ASCII digits (^[0-9]{1,2}$) before the comparison. The code below is a reduced, source-shaped illustration of that boundary, not a complete product script or proof of exploitability. The advisory reports initial exploitation attempts on February 10 and limited exploitation of internet-facing self-hosted systems that remained unpatched before February 9. Google Threat Intelligence Group later reported multiple clusters exploiting the CVE after disclosure and described varied follow-on activity. Those reports establish observed exploitation; they do not mean every compromised appliance had the same post-exploitation chain.
Step-by-Step Attack Flow
A public appliance accepts the protocol connection
The affected service exposes a WebSocket path used by its thin-client protocol. Reporting by Rapid7 describes the vulnerable path as reachable without authentication; BeyondTrust classifies the issue as pre-authentication RCE.
The peer supplies a protocol version
The wrapper reads a remote protocol-version value from the connection. It is attacker-controlled input, not trusted local configuration.
Bash treats the value as an arithmetic operand
The vulnerable comparison uses Bash numeric operators. Bash evaluates numeric operands as arithmetic expressions, so an unchecked value is not guaranteed to remain plain data.
Command injection reaches the service account
Successful exploitation can execute operating-system commands in the context of the BeyondTrust site user. The vendor rates confidentiality, integrity, and availability impact as high.
Observed exploitation adds follow-on risk
BeyondTrust reported initial attempts and limited activity against internet-facing, unpatched self-hosted appliances. GTIG later reported several threat clusters and follow-on actions; treat each report as campaign-specific evidence, not a universal chain.
The patch validates before comparison
The vendor patch rejects an invalid remote version and exits the wrapper; only a valid value proceeds to protocol negotiation. Apply the matching product patch or fixed release and investigate appliances that were exposed while unpatched.
Source Code: Flaw vs. Secure Implementation
Rapid7 reports that the BT26-02 patch adds this one-or-two-digit validation before comparing the client’s remoteVersion. The snippets are intentionally reduced and omit the product protocol and all request details. The important invariant is that validation occurs before Bash arithmetic evaluation; escaping or quoting alone does not make arithmetic operands safe. Keep parsing and comparison in a typed, non-shell component where possible, and reject invalid values at the protocol boundary.
Source excerpt: thin-scc-wrapper — reduced illustration based on Rapid7's analysis of the vendor patch
# Reduced example: remoteVersion comes from the peer.
read -r remoteVersion || exit 1
if [[ "$localVersion" -lt "$remoteVersion" ]]; then
version=$localVersion
else
version=$remoteVersion
fi# Reject unexpected input before any arithmetic comparison.
read -r remoteVersion || exit 1
if [[ ! "$remoteVersion" =~ ^[0-9]{1,2}$ ]]; then
exit 1
fi
if [[ "$localVersion" -lt "$remoteVersion" ]]; then
version=$localVersion
else
version=$remoteVersion
fiEngineering & System Hardening Checklist
- ✓Identify all Remote Support and Privileged Remote Access appliances, including self-hosted systems that do not receive automatic updates.
- ✓Apply BT26-02-RS or upgrade Remote Support to 25.3.2 or later; apply BT26-02-PRA or upgrade Privileged Remote Access to 25.1.1 or later, following BeyondTrust’s current advisory for the exact appliance path.
- ✓For self-hosted instances that were internet-facing and unpatched on or before February 9, 2026, follow BeyondTrust’s incident-response instructions and investigate for unauthorized access, persistence, privilege escalation, and data access.
- ✓Review network and application telemetry for unexpected WebSocket sessions to the affected service and unusual child processes or commands launched by the service account; validate detections against the appliance’s normal behavior.
- ✓At every shell boundary, validate protocol fields against a strict allowlist before numeric comparison; do not pass untrusted text into Bash arithmetic,
eval, or a command string. - ✓Add regression tests for empty, oversized, signed, whitespace-containing, and non-decimal protocol-version values; require rejection before any comparison or process launch.