BeyondTrust Remote Support Flaw CVE-2026-102764 Exploited in the Wild as Full Details and Metasploit Exploit Go Public

TL;DR

Rapid7 has published a full technical analysis and a working Metasploit module for CVE-2026-102764. This BeyondTrust Remote Support vulnerability is already exploited in the wild. The flaw scores 9.3 on CVSS v4. According to Rapid7, it lets “an unauthenticated attacker write files on the appliance and execute code as the site’s operating-system user.”

Attackers abused this zero-day from August 2026, well before BeyondTrust disclosed it on October 15. Now, Rapid7’s write-up and Metasploit module make the exploit chain public. Apply the BT26-05-RS patch immediately, since the bar for attackers just dropped further.

Why It Matters

Confirmed attacks

BeyondTrust has confirmed that “exploitation in the wild has already occurred prior to disclosure,” according to Rapid7’s earlier analysis. BeyondTrust dates two known compromises to August 29, 2026. One hit a BeyondTrust-hosted instance, and the other a self-hosted appliance.

Mandiant attributes the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221. Moreover, CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16. Federal agencies had until October 19 to fix it. Canada’s Cyber Centre also issued an alert on the bug.

Public exploit code

Until now, the technical details remained private. However, Rapid7’s new analysis explains the full chain, and “a Metasploit module now implements the chain with PHP and Unix Command targets.” As a result, many more attackers can now target unpatched servers. Remote Support also has a history here. CISA’s catalog already lists three earlier Remote Support flaws: CVE-2024-12356, CVE-2024-12686 and CVE-2026-1731.

How the Attack Works

Forged local origin

The BeyondTrust Remote Support vulnerability sits between an internal message router and a customer-side worker process. Rapid7 explains that “an attacker can put a reserved local router ID into a message’s source address.” The router then forwards the message, and the worker “accepts that address as proof that the request came from a local component.”

Notably, the router has an anti-spoofing check. However, it only compares the source against the router’s actual ID, not the reserved local alias. That gap lets a network message pass as local.

From file write to code execution

The entry point is the public customer connection used to start a support session. Rapid7 stresses that “no account credentials or user interaction are required.” Once the forged message passes, the attacker reaches an internal file-transfer service.

The attacker then controls both a file’s contents and its destination path. In Rapid7’s test, the service could write into the PHP document root. Requesting the uploaded file gave code execution as the site user. The same flaw can also send files back to the attacker, which helped reveal the installation path.

Affected Versions

• Self-hosted Remote Support 26.2.3 and earlier, unless the BT26-05-RS patch is applied
• SaaS Remote Support was patched by BeyondTrust as of October 9, 2026
• Self-hosted Privileged Remote Access shares the affected code, though BeyondTrust has not found an exploit path there

Rapid7 tested Remote Support 24.1.2 with default settings. In its own words, “other affected releases and fixed builds have not been established” by its testing. That build predates the patch-supported range, so older appliances need an upgrade first.

Patch and Mitigation

Apply the BT26-05-RS patch, which covers versions 24.3.1 through 26.2.3. If you run an older release, first upgrade to a supported version, then patch. Admins can confirm the patch in the /appliance interface. Install it manually if automatic updates are off.

Because attacks began in August, patching alone is not enough. Teams should also hunt for unexpected PHP files in the web root and review appliance logs from late August onward. Keep in mind that Rapid7’s module deletes its PHP file before running the payload. So a clean web root does not prove an appliance was never hit. PRA customers should confirm the right patch with BeyondTrust Support.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.