Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain Control

A critical vulnerability tracked as CVE-2026-1731 is being actively exploited in the wild, enabling attackers to gain full domain control over affected systems.

Threat actors are leveraging this flaw to execute operating system commands remotely without authentication.

The flaw, discovered in self-hosted BeyondTrust deployments, allows unauthenticated attackers to run arbitrary OS commands via specially crafted HTTP requests, executing them under the site user’s privileges.

Cloud-hosted BeyondTrust instances have already been automatically patched as of February 2, 2026. However, self-hosted customers must apply updates manually to mitigate exploitation risks.

Technical Details

Arctic Wolf’s analysis revealed attackers deploying SimpleHelp Remote Access binaries as part of their post-exploitation activity.

These binaries were created through BeyondTrust Bomgar processes running under the SYSTEM account and saved in the ProgramData directory, commonly named remote access.exe.

The attackers used net user and net group commands to create privileged domain accounts, effectively granting themselves Enterprise Admin or Domain Admin rights.

For reconnaissance, the AdsiSearcher function was executed to enumerate Active Directory computers, alongside network discovery commands such as net share, ipconfig /all, and systeminfo.

Arctic Wolf investigators noted the use of PSExec and Impacket SMBv2 session setup requests, suggesting coordinated propagation of the SimpleHelp tool across multiple networked hosts.

Security experts strongly advise patching all vulnerable versions immediately. All cloud-based BeyondTrust customers are already protected.

CISA advises that self-hosted deployments running versions older than RS 21.3 or PRA 22.1 must first be upgraded before applying the patch.

Administrators should review systems for unauthorized SimpleHelp binaries, suspicious admin accounts, and unusual network traffic related to SMB sessions.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.