BeyondTrust Remote Support RCE Exploit Published as Targeted Probes Emerge

Rapid7 published technical details and a Metasploit exploit module for CVE-2026-102764, an unauthenticated file-upload vulnerability in BeyondTrust Remote Support that can lead to remote code execution. An origin-validation flaw allows an attacker entering through the public customer-session interface to impersonate a local message origin and access an appliance-side file-transfer service. Researchers demonstrated the attack against version 24.1.2 by uploading PHP into the public web directory and invoking it to execute code as the site's operating-system user, not root. The attack requires neither credentials nor user interaction. Rapid7's analysis and module testing did not establish the complete affected-version range or demonstrate attacks against real-world victims.

Subsequent reporting identified affected unpatched releases as 26.2.3 and earlier, assigned a CVSS score of 9.3, and cited BeyondTrust's guidance to apply BT26-05-RS to self-hosted deployments. Previdian observed two probes against decoy appliances in the United States and Europe from a single Hong Kong-geolocated IP address, with no successful exploitation; that limited evidence does not establish mass scanning or identify the operator. Cryptika also reported that Mandiant had linked earlier successful zero-day exploitation to ARMORY CASTLE, a suspected China-linked espionage group formerly tracked as UNC5221. Organizations should prioritize the vendor patch, restrict external access, and investigate potentially exposed appliances for compromise, consistent with the reported CISA recommendations.