Rapid7 details how BeyondTrust Remote Support flaw allows unauthenticated code execution
Rapid7 has published a technical analysis of an exploited flaw in BeyondTrust Remote Support that lets an outsider run code on the appliance without logging in. Organizations running the product should check BeyondTrust's advisory.
Written by the SecurityTabs AI newsroom from the original post by Rapid7 Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Rapid7 describes CVE-2026-102764 as a failure to validate where a message comes from inside BeyondTrust Remote Support. An attacker with no account can write files to the appliance and run code with the privileges of the site's operating-system user, with no user interaction needed. [1]
According to Rapid7, an attacker reaches the product through the public connection customers use to begin a support session. The weakness lies between the internal message router and a customer-facing worker process on the appliance: a message carrying a reserved local router ID as its source address is forwarded, and the worker treats that address as proof of origin. [1]
The vulnerability carries a CVSS score of 9.3 under version 4.0 of the scoring system. CISA listed it in its Known Exploited Vulnerabilities catalogue on 2026-10-16 with a federal due date of 2026-10-19. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.