The cybersecurity company BeyondTrust has disclosed and patched a critical pre-authentication remote code execution (RCE) vulnerability affecting its Remote Support and Privileged Remote Access products. The flaw, tracked as CVE-2026-1731 (CVSS 9.9/10), stems from an operating system command injection weakness that allows unauthenticated attackers to execute arbitrary system commands without user interaction, potentially resulting in full system compromise, data exfiltration, and service disruption. The issue impacts Remote Support versions 25.3.1 and earlier and Privileged Remote Access versions 24.3.4 and earlier and has been fixed in Remote Support 25.3.2 (Patch BT26-02-RS) and Privileged Remote Access 25.1.1 (Patch BT26-02-PRA), with BeyondTrust confirming that all cloud-hosted environments were secured by February 2, 2026. However, the company is urging self-hosted customers to manually apply patches or upgrade if automatic updates are not enabled, as research indicates roughly 11,000 internet-exposed instances exist, including approximately 8,500 on-prem deployments that remain vulnerable if unpatched. While there is currently no evidence of active exploitation, the advisory carries heightened urgency given BeyondTrust’s history of RS/PRA vulnerabilities being leveraged in zero-day attacks, reinforcing the need for immediate remediation across affected environments. CTIX analysts urge any administrators responsible for self-hosting to ensure that they have automatic updates enabled.