BeyondTrust Remote Support RCE via Unauthenticated File Upload (CVE-2026-102764)

What happened

BeyondTrust Remote Support, a popular remote‑assistance appliance, suffered an origin‑validation flaw that lets an unauthenticated actor write arbitrary files to the appliance’s filesystem and then execute code as the OS user. The flaw is triggered through the public customer‑connection endpoint that initiates a support session, requiring no credentials or user interaction.

The vulnerability resides between the internal message router, the brain component, and the thin‑scc worker that handles customer requests. An attacker can inject a reserved local router ID into the source address of a message. The router forwards the packet, and the worker treats the forged address as proof of a local component, granting access to the internal file‑transfer service and its native filesystem provider.

Who is affected

The affected product is BeyondTrust Remote Support version 24.1.2, build 1524046, revision 4208‑ddcf90715106aa0c0e19c103f8d2c412af4beff3. The vulnerability is present in appliances that expose the public issue‑menu session start and thin‑chat features, which are enabled by default. The base appliance version of Secure Remote Access (7.1.0) is separate and not impacted by this flaw.

BeyondTrust has not yet published a patch or identified whether earlier or later releases contain the fix. Therefore, any deployment of the specified build or any build that still exposes the public session‑start endpoint remains at risk.

Impact

Once the attacker writes a file, they control both the file’s contents and its destination path, subject to the thin‑scc worker’s filesystem permissions. In the test environment, the native file service could write into the PHP document root, allowing the attacker to upload a malicious PHP script.

Executing the uploaded script yields remote code execution with the privileges of the appliance’s operating‑system user. The attacker can also use the same origin‑forgery to retrieve sensitive files such as /proc/self/environ, revealing the installation path and other runtime information that aids further exploitation.

Exposure

The flaw can be leveraged from any network that can reach the appliance’s public customer‑connection port. No authentication is required, and the attack chain is fully automated. A Metasploit module has been released that performs the file‑upload and execution steps against PHP and Unix command targets.

Because the vulnerability is tied to the public session‑start endpoint, internal networks that restrict inbound traffic to the appliance are less likely to be exposed, but any remote access or VPN that forwards traffic to the appliance still poses a risk.

What to do

• Verify the appliance version. If you run Remote Support 24.1.2 build 1524046 or any build that still exposes the public session‑start endpoint, treat the system as compromised.
• Apply the vendor‑issued patch as soon as it becomes available. If no patch is released, consider disabling the public session‑start feature or removing thin‑chat from the configuration.
• Block inbound traffic to the public customer‑connection port (typically TCP 443) from untrusted sources using firewall rules or network segmentation.
• Enable logging for the thin‑scc worker and monitor for anomalous file‑write events or unexpected PHP file creation in the document root.
• Perform a full integrity check of the appliance’s filesystem and verify that no unauthorized PHP or binary files exist.

What to watch

BeyondTrust has not yet released a fix, so keep an eye on the vendor’s security advisories and the Rapid7 advisory page for updates. Monitor the CVE‑2026‑102764 entry on NVD and the Rapid7 GitHub repository for new exploit code or mitigation guidance.

In the meantime, maintain a robust change‑management process for appliance upgrades and enforce least‑privilege access controls on the appliance’s management interface to reduce the attack surface.