Threat Intelligence Report

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

📅 February 20, 2026 📰 unit42.paloaltonetworks.com 🔍 1 CVE(s) referenced

Attackers are actively exploiting a critical remote code execution vulnerability in BeyondTrust remote support software (CVE-2026-1731), deploying tools like VShell and SparkRAT to compromise systems across multiple sectors, enabling unauthorized access, data theft, and persistent backdoor control.

vendor

CVE-2026-1731

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap

🎯 IOC Extraction

⚔️ MITRE ATT&CK TTPs

📦 STIX 2.1 Bundle