AISEC > Security News > BeyondTrust RCE Flaw Exploited in Active Ransomware Attacks: CISA Alert
February 20, 2026 #ransomware Source: BleepingComputer 2 min read · 568 words

CISA: BeyondTrust RCE flaw now exploited in ransomware attacks

CISA: вразливість RCE у BeyondTrust тепер експлуатується в атаках програм-вимагачів

Timeline: The Attack Is Happening Right Now

February 20, 2026. That's when CISA went public with something that should make every IT administrator nervous: hackers aren't just aware of CVE-2024-1731 anymore. They're weaponizing it. The BeyondTrust Remote Support RCE vulnerability isn't theoretical. It isn't a lab exercise. Real threat actors are deploying ransomware against actual targets using this flaw.

This isn't a future threat.

According to BleepingComputer, the vulnerability has been circulating in security circles for months, but the shift from "known risk" to "actively exploited in the wild" changes everything. CISA doesn't issue warnings lightly. When they flag something as actively exploited, organizations should treat it as a five-alarm fire.

The Discovery

Security researchers identified the BeyondTrust Remote Support RCE vulnerability in the platform's core authentication mechanism. The flaw allows unauthenticated attackers to execute arbitrary code remotely—which is about as bad as it gets. No credentials needed. No social engineering required. Just network access and the vulnerability becomes an open door.

And then researchers noticed something worse: proof-of-concept code was circulating publicly.

Once PoC code hits the internet, it's only a matter of time before organized attackers weaponize it. That window has apparently closed. BeyondTrust Remote Support is used by thousands of organizations globally—enterprises, managed service providers, help desk teams. It's the kind of software that sits in trusted zones of networks. The kind of tool that people don't expect to be the attack vector.

Technical Analysis

Here's what's actually happening: CVE-2024-1731 exploits a flaw in how BeyondTrust Remote Support handles session validation. An attacker sends a specially crafted request that bypasses authentication checks entirely. The application then executes the attacker's code with system privileges.

Remote code execution. At system level. No credentials. That's the nightmare scenario.

The technical details matter because they explain why this is spreading so quickly. It's not some obscure edge case vulnerability that requires multiple steps to exploit. It's straightforward. It's reliable. For ransomware operators, that makes it valuable. They can automate attacks, scale them across multiple targets, and maintain persistence on compromised networks before deploying their payload.

What makes this particularly nasty: BeyondTrust Remote Support is often used to manage critical infrastructure. Healthcare networks. Financial institutions. Manufacturing plants. The tools that attackers compromise here become the tools that defenders can't use to respond.

Damage Assessment

CISA hasn't released specific numbers on organizations hit so far. But they've elevated this to an active threat alert, which means they've observed confirmed exploitation in the wild.

The real question is: how many organizations haven't patched yet?

BeyondTrust released patches. The patches are available. But in the real world, patching takes time. Testing takes time. Scheduling downtime takes time. Meanwhile, ransomware operators don't wait. They scan networks, identify unpatched BeyondTrust instances, and launch attacks. Frankly, every day that passes without patching is another day the attack surface expands.

Mitigation

First: patch immediately. BeyondTrust has released security updates for affected versions. This isn't optional. This isn't "patch in the next quarter." This is patch today.

Second: segment your network. If BeyondTrust Remote Support doesn't need direct internet access, restrict it. If it doesn't need to communicate with all systems, lock it down. Assume it will be compromised and design controls accordingly.

Third: monitor. Look for unusual authentication patterns, failed login attempts against other systems originating from BeyondTrust servers, and any unexpected code execution. CISA's cybersecurity evaluation tool and other detection frameworks can help identify compromise indicators.

This vulnerability is serious. The exploitation is real. The patches exist. The gap between those two facts—that's where ransomware operators live.

Read original article →

// RELATED

#ransomware Mississippi Hospital System Closes All Clinics After Ransomware Attack 2026-02-23 #ransomware Japanese tech giant Advantest hit by ransomware attack 2026-02-20

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →