BeyondTrust Secure Remote Access - XSS (CVE-2021-31589)

CVE-2021-31589 is a cross-site scripting (XSS) vulnerability affecting BeyondTrust Secure Remote Access. It enables attackers to inject unauthenticated, specially crafted web requests through insufficient sanitization in the login interface.

CrowdSec has been tracking this vulnerability and its exploits since 31st of March 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2021-31589 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec data also reveals a clear uptick in attacks involving CVE-2021-31589 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Observed exploitation attempts target URLs containing /appliance/login.ns.