BeyondTrust Remote Support flaw yields unauthenticated RCE
Original title: Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)
Rapid7’s Metasploit module writes a PHP file via a forged local router ID and runs it as the site user.
Rapid7 says an origin-validation flaw in BeyondTrust Remote Support, CVE-2026-102764, lets an unauthenticated attacker write files and execute code as the site operating-system user. A public customer session can place a reserved local router ID in a message source address; the customer worker then treats it as a local component and exposes an internal file-transfer service. On Remote Support 24.1.2, build 1524046, researchers uploaded PHP to the document root and got code execution as UID 1000. Other affected releases and fixed builds have not been established.
Unconfirmed: Rapid7 has not established the full set of affected releases or any fixed builds.
- No credentials or user interaction are required.
- The tested build is 24.1.2, build 1524046, revision 4208.
- Public issue-menu session starts and thin chat were enabled by default.
- The module includes PHP and Unix Command targets.
- Secure Remote Access 7.1.0 on the VM is separate from the app version.
Impact: Unauthenticated remote code execution as the site user
| Product | Affected |
|---|---|
| BeyondTrust Remote Support | 24.1.2, build 1524046 (tested); other releases not established |
- CVEs
- CVE-2026-102764
- Vendors
- BeyondTrust
- Products
- Remote Support
- Organizations
- Rapid7
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102764 | Message-origin spoofing enables file ops on BeyondTrust Remote Support | 9.3 | 19% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | ddcf90715106aa0c0e19c103f8d2c412af4beff3 | tested Remote Support 24.1.2, build 1524046 , revision 4208-ddcf90715106aa0c0e19c103f8d2c412af4beff3 . The test appliance had public issue-menu session starts a |
From the original article
13 min read at rapid7.comOverview An origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user. The entry point is the public customer connection used to start a support session. No account credentials or user interaction are required.
By Jack Heysel · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.