Hospitals at Risk of BeyondTrust Ransomware Hacks

U.S. federal authorities and industry officials are urging hospitals and clinics to address a critical flaw in BeyondTrust Remote Support and Privileged Remote Access software, which if exploited, could give an attacker a foothold inside a corporate network.

See Also: AI Pushes Cyberattacks to New Speed Levels

The U.S. Department of Health and Human Services in an alert Thursday warned healthcare and public health sector organizations to review and address the vulnerability in light of rising cyberattacks targeting those entities. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw, tracked as CVE-2026-1731 on Feb. 13 to its catalog of known exploited vulnerabilities and gave federal agencies just three days to fix it. It updated the entry on Friday to warn that ransomware hackers have begun exploiting it.

Palo Alto Network’s Unit 42 also published a report on Thursday saying hackers were actively exploiting the flaw.

Threat actors are weaponizing the vulnerability to gain unauthorized control over appliances, facilitating broad malicious activities ranging from data theft to persistent network access.

BeyondTrust published security advisory warning that exploitation “may lead to system compromise, including unauthorized access, data exfiltration and service disruption.”

The privileged access management firm published patches on Feb.2, which were automatically deployed to instances with the update service enabled and fully applied to software-as-a-service environments.

The Health Information Sharing and Analysis Center on Feb. 11 also alerted the healthcare sector about the flaw.

“Healthcare entities typically use BeyondTrust Remote Support to let IT and clinical engineering teams securely access and troubleshoot end user systems, including clinician workstations and kiosks, without needing users to be on site,” said Errol Weiss, chief security officer of Health-ISAC. “It’s a key remote access and support layer in many hospital environments,” he said.

BeyondTrust is commonly deployed in medium and large provider organizations, Weiss said. Based on Health-ISAC visibility and prior targeted alerting on BeyondTrust vulnerabilities, it’s widely used but not universal across hospitals and large healthcare organizations, he said.

Weiss declined to say whether any of Health-ISAC members have been victims of the BeyondTrust flaw – or a particular vulnerability or exploit, for that matter. “We have, however, seen BeyondTrust exploited in prior campaigns when critical vulnerabilities were disclosed, which is why we moved quickly with our vulnerability bulletin,” he said.

“Given the severity and ease of exploitation, it is highly likely that threat actors will attempt to weaponize this in the near term, especially against exposed or unpatched instances,” he said.

The BeyondTrust vulnerability is a critical severe, remotely exploitable and present in a platform that often has elevated access into sensitive systems, he said. “That combination makes it a prime target for ransomware groups.”

“Because BeyondTrust often has connectivity to many internal assets, compromise of this platform has the potential to quickly become an enterprise wide incident that impacts patient care,” Weiss said.