Rapid7 details remote code execution flaw in BeyondTrust Remote Support

Rapid7 reported that an origin-validation vulnerability in BeyondTrust Remote Support allows unauthenticated attackers to write files and execute code on the appliance as the operating-system user. The attack vector uses the public customer connection that typically starts a support session. CyberSecurityNews also covered remote support security flaws that enable computer takeovers. [1][2]

The vulnerability, identified as CVE-2026-102764, requires no account credentials or user interaction to exploit. Attackers leverage the public customer connection to achieve execution on the underlying operating system. Rapid7 analysed the security flaw, which affects the core appliance handling support connections. [1]

BeyondTrust is an American technology company that develops privileged access management and vulnerability management software, as FTMQ Security reported earlier. FTMQ Security previously reported that the CVE-2026-102764 zero-day vulnerability was exploited by Chinese state hackers for seven weeks. BeyondTrust released security patches on October 8, 2026, and disclosed the flaw publicly on October 15, 2026. The vulnerability impacted more than 1,400 self-hosted appliances, affecting software versions 26.2.3 and earlier. [4][6][7]