Summary
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.
- Vendor
- BeyondTrust
- Product
- Remote Support (RS) and Privileged Remote Access (PRA)
- Added to KEV
- Feb 13, 2026
- Remediation due
- Feb 16, 2026 (US federal deadline)
- Ransomware use
- Known
- Weakness
- CWE-78
- EPSS
- 93.9% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References