Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)
Unauthenticated RCE in BeyondTrust Remote Support via file upload flaw.
A critical origin-validation vulnerability in BeyondTrust Remote Support allows unauthenticated attackers to upload arbitrary files and execute code as the site's OS user. The flaw, identified as CVE-2026-102764, is triggered through the public customer connection used to initiate support sessions, requiring no credentials or user interaction. Attackers can exploit this to gain remote code execution by uploading a malicious PHP file to the web server's public directory.
AI summary of the linked source. Not reviewed by an editor. How this works
Run BeyondTrust?
Get an email when a new story names BeyondTrust, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical origin-validation flaw in BeyondTrust Remote Support (CVE-2026-102764) allows unauthenticated attackers to upload malicious PHP files through the public-facing customer connection portal and achieve remote code execution with no credentials or user interaction required. This is particularly dangerous because BeyondTrust is a privileged access management tool, meaning a compromised instance can act as a launchpad into every system it manages. The vulnerability is reachable before any authentication gate, collapsing the assumption that internet-facing support portals are inherently low-risk entry points. Organizations that delay patching internet-exposed critical infrastructure dramatically expand their attack surface and risk full environment compromise through a single unpatched endpoint.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-102764