{"uuid": "4ed8e4d4-8d4a-4fc2-b571-1dcaebbfa45d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1731", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Harsh Jaiswal\", \"Jonah Burgess (CryptoCat)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit achieves unauthenticated remote code execution against BeyondTrust Privileged Remote\\n          Access (PRA) and Remote Support (RS). The module targets CVE-2026-1731, a direct command injection affecting RS versions 25.3.1 and prior, and PRA versions 24.3.4 and prior.\\n          Exploitation occurs with the privileges of the site user of the targeted BeyondTrust product site.\", \"disclosure_date\": \"2026-02-06\", \"fullname\": \"exploit/linux/http/beyondtrust_pra_rs_command_injection\", \"is_install_path\": true, \"mod_time\": \"2026-03-03 15:42:15 +0000\", \"name\": \"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/beyondtrust_pra_rs_command_injection\", \"references\": [\"CVE-2026-1731\", \"URL-https://www.beyondtrust.com/trust-center/security-advisories/bt26-02\", \"URL-https://attackerkb.com/topics/jNMBccstay/cve-2026-1731/rapid7-analysis\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Command Injection\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:24.591600Z"}