Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

BeyondTrust Remote Support CVE-2026-102764 Unauthenticated RCE

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

BeyondTrust Remote Support CVE-2026-102764 enables unauthenticated file upload to RCE as site user; CISA added to KEV with active exploitation.

An origin-validation flaw in BeyondTrust Remote Support lets unauthenticated attackers write files and execute code as the site OS user by forging a local router ID. The public customer session exposes an internal file-transfer service. Rapid7 analyzed the issue on October 30, 2026, and Cyber Security News reported probes and CISA KEV addition on November 2, 2026. The flaw affects versions up to 26.2.3 with CVSS score 9.3; BT26-05 patches are available for versions 24.3.1 through 26.2.3.

Key facts
  • CVE-2026-102764 allows unauthenticated file upload to RCE
  • Affects versions up to 26.2.3
  • CVSS 9.3
  • CISA added to KEV October 16, 2026
  • BT26-05 patch available for 24.3.1-26.2.3
  • Metasploit module writes PHP via forged local router ID
Analyze CVE-2026-102764 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 16, 2026CISA adds CVE-2026-102764 to KEV · Cyber Security News
  2. Oct 30, 2026Rapid7 analyzes unauthenticated file upload RCE · Rapid7 Blog
  3. Nov 2, 2026Probes reported against BeyondTrust Remote Support · Cyber Security News

What each outlet adds

beyond the shared facts
  • Rapid7 BlogDetails technical flaw with forged local router ID for PHP upload to document root
  • Cyber Security NewsReports active exploitation, CISA KEV addition, and BT26-05 patch for versions 24.3.1-26.2.3
CVEs
CVE-2026-102764
Vendors
BeyondTrust
Products
Remote Support
Threat actors
ARMORY CASTLE
Organizations
CISAMandiantPrevidianRapid7
Countries
Hong KongChina

Coverage

oldest first · one row per article · UTC
  1. · 3d ago Rapid7 BlogFirst report

    BeyondTrust Remote Support flaw yields unauthenticated RCE

    Rapid7’s Metasploit module writes a PHP file via a forged local router ID and runs it as the site user.

  2. · 16h ago Cyber Security News

    BeyondTrust Remote Support Faces Fresh Probes for Critical Flaw

    Probes target BeyondTrust Remote Support versions 26.2.3 and earlier; CISA added to KEV with active exploitation.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-102764
Message-origin spoofing enables file ops on BeyondTrust Remote Support
9.319%KEVPoC ×2
KEV