Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support Remote Support (CVE-2026-102764)
BeyondTrust Remote Support has a disclosed vulnerability (CVE-2026-102764).
BeyondTrust Remote Support has a disclosed vulnerability (CVE-2026-102764).
The affected service is reachable from the network without authentication.
BeyondTrust Remote Support may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.
Anyone running BeyondTrust Remote Support is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
Systems like this are placed at the edge of the network by design -- exactly where attackers scan first the moment a CVE is made public.
This is tracked as CVE-2026-102764 -- use that identifier when checking vendor guidance or scanner results.
Confirm whether BeyondTrust Remote Support is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
BeyondTrust Remote Support has a disclosed vulnerability (CVE-2026-102764).
The affected service is accessible from the network without authentication.
BeyondTrust Remote Support may be operating normally in your environment while also being reachable from a network an attacker can access.
Who is affected
Anyone running BeyondTrust Remote Support is at risk, and because this is accessible without authentication, exposure does not depend on user actions.
Why it matters
Successful exploitation allows an attacker to execute code with the permissions of the affected process.
These systems are intentionally placed at the network's edge, making them prime targets for attackers immediately after a CVE is published.
Technical details
This vulnerability is tracked as CVE-2026-102764; use this identifier when checking vendor guidance or scanner results.
What security teams should do
Verify whether BeyondTrust Remote Support is listed in your asset and software inventory.
Although no exploitation has been reported yet, that status could change, so continue monitoring vendor guidance while you remediate.