> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # BeyondTrust Remote Support unauth RCE CVE-2026-102764 - URL: https://f4n6.co.uk/security-feed/beyondtrust-remote-support-unauth-rce-cve-2026-102764/ - Published: 2026-10-30T20:56:58.000Z - Updated: 2026-10-30T20:56:58.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-102764 ## 1\. Executive summary CVE-2026-102764 is an authentication bypass by spoofing (CWE-290) in BeyondTrust Remote Support that lets an unauthenticated attacker write files to the appliance and execute code as the site's operating-system user. NVD scores it CVSS 9.3 critical, CISA added it to KEV on 2026-10-16 with a 2026-10-19 remediation due date, and EPSS puts 30-day exploitation probability at 19%. BeyondTrust confirmed exploitation in the wild before disclosure, with two compromises dated to 2026-08-29 (one hosted instance, one self-hosted appliance), and Mandiant's investigation of the self-hosted case describes SAWFLY web-shell deployment, BARECLAW tunneler use, root escalation and log deletion. Any EMEA financial services firm running a self-hosted Remote Support appliance at 26.2.3 or earlier without the BT26-05-RS patch should treat it as compromised until forensic triage proves otherwise, and the KEV due date has already passed. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 19 | BeyondTrust confirmed two in-the-wild compromises dated 2026-08-29, one of them a self-hosted appliance, and Mandiant found root escalation, credential-vault extraction attempts and log deletion. | A self-hosted Remote Support appliance is an ICT third-party system in the support path. If a client's appliance was compromised, the incident is reportable as a major ICT-related incident to the competent authority once classified under Art. 18; the August date means the reporting clock is already running against a known compromise window. | | DORA Art. 28 | The flaw is in a third-party remote-support product, the vendor withheld exploitation details while customers patched, and remediation requires applying a vendor patch (BT26-05-RS) or upgrading from versions older than 24.3.1. | Third-party risk management must cover the patch-application path for the appliance, including whether automatic updates are enabled and who applies the patch manually through the /appliance interface. Contractual and monitoring obligations toward the vendor are engaged. | | NIS2 Art. 21(2)(d) | The same supply-chain exposure: a compromised support appliance gives an attacker a route into the estate through a supplier-maintained component. | Entities in scope must be able to show supply chain security measures covering this appliance, including patch status evidence and vendor notification handling. | ## 3\. Technical analysis & attack chain The entry point is the public customer connection used to start a support session. No credentials and no user interaction are required. Rapid7 tested Remote Support 24.1.2, build 1524046, revision 4208-ddcf90715106aa0c0e19c103f8d2c412af4beff3, with public issue-menu session starts and thin chat enabled (default). The vendor states 26.2.3 and earlier are affected unless BT26-05-RS is applied. Rapid7 notes that other affected releases and fixed builds were not established in its lab work, which is a gap against the vendor's version range. Confirmed chain, from Rapid7's analysis: 1. The attacker calls POST /api/start\_session twice and receives two fresh public guest customer keys. These keys authorise the customer transport but do not identify a logged-in account. Each guest connects through the /nw WebSocket endpoint. 2. The native customer protocol reaches the brain socket at $BG\_app\_root/data/tmp/brain.sock. The thin customer protocol launches $BG\_app\_root/app/thin-scc-wrapper, which checks the key against an unexpired sdcust session in gw\_sessions and then starts the appliance-side worker thin-scc with BRAIN\_MELD\_SOCKET\_PATH set to the brain socket. A key from the public session-start endpoint passes this check, so an anonymous guest gets a worker running on the appliance. 3. The attacker sends an MRS message with a forged source address. MRS addresses are node:router:handler, carried in a 36-byte header of nine little-endian 32-bit fields. The exploit sets the source router field (offset 0x08) to the reserved local alias 1 and addresses the worker's main dispatcher, handler 2048 on the tested build. 4. brain's anti-spoofing check in FUN\_01566ae0 rejects a network packet whose source router equals the receiving router's actual ID, but the local-address predicate FUN\_0155ad40 evaluates node AND (router == 1 OR router == actual local router). Router 1 returns true without the actual-ID comparison. The forwarding path passes the packet on without stripping the caller-supplied source claim. 5. thin-scc's message-origin wrapper passes the dispatched message's sender address into the same predicate. The file-transfer dispatcher FUN\_0047a850 discards a message only if that wrapper says the sender is nonlocal. With the forged source, the check passes and ftsName is matched against the service instance name. 6. The attacker selects ftsName=local, the native filesystem provider constructed in the ServerContext constructor FUN\_002ae620\. The worker also has a session service that delegates filesystem work to the browser; a transfer through that service does not prove a file was written on the appliance. Only the local provider writes to the appliance filesystem. 7. The attacker invokes DownloadAnonymousFiles, which receives bytes onto the appliance. The request carries a caller-supplied downloadToken, a caller-supplied serverAddress (an MRS listener the attacker controls), and a caller-supplied absolute destination path. The worker opens an MRS stream to that address, sends "get anonymous file" with the token, and the attacker's listener serves the file bytes. The receive loop copies dest\_filename from the transfer metadata, opens the file with mode "a+b", and writes incoming data. When a temporary path is used it ends in .n$t and is renamed to the final destination on completion. The service accepts an absolute path, so no directory traversal is needed. 8. The attacker writes a PHP file into the document root. On the tested appliance config/apache\_vhost.conf sets it to /home/msfuser/ingredi-24.1.2/app/www/public. A direct request to a .php URL returns 404 because app/www/public/.htaccess rejects requests matching .php\[?/ \], but a second rule maps an extensionless URL to an existing PHP file. Requesting the basename without .php executes the payload. 9. Execution is as msfuser, UID 1000, gid 1000, groups 1000(msfuser),16(cron),70(postgres). Rapid7's Metasploit module exploit/linux/http/beyondtrust\_rs\_mrs\_file\_upload implements the chain with target 0 (PHP payload) and target 1 (Unix command wrapped in PHP). It writes a random PHP filename, POSTs an execution token to the extensionless URL, and the PHP file checks the token and unlinks itself before executing. The same origin forgery reaches the file-send operation UploadFiles. Rapid7 used it to read /proc/self/environ and recover BG\_app\_root, which gives the installation directory directly; appending /app/www/public gives the upload destination. procfs reports the environment file's size as zero but the worker still streams its contents, so the reader must go to EOF rather than trust the advertised size. Post-exploitation, from Mandiant's investigation as reported by Rapid7: arbitrary file uploads, deployment of the SAWFLY PHP web shell and the BARECLAW tunneler, root escalation, attempted credential-vault extraction, persistence, and log deletion. Mandiant attributes the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221\. ARMORY CASTLE has no MITRE ATT&CK profile in the data available to this advisory, so the attribution is unconfirmed here and should be treated as Mandiant's assessment, not a corroborated fact. The post-exploitation detail is single-sourced to Mandiant via Rapid7; verify before building detection or scoping decisions on it alone. BeyondTrust is withholding exploitation details while customers patch. The Rapid7 analysis above is a full technical reconstruction published the same day and should be assumed available to any adversary. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory every self-hosted Remote Support appliance and confirm its version through the /appliance interface. Anything at 26.2.3 or earlier without BT26-05-RS is in scope. Instances older than 24.3.1 must be upgraded to a patch-supported version first, then patched. - Apply BT26-05-RS. It is available for versions 24.3.1 through 26.2.3\. Apply it manually if automatic updates are not enabled. The CISA KEV due date of 2026-10-19 has passed, so this is overdue, not scheduled. - Patch self-hosted Privileged Remote Access as well. BeyondTrust states PRA shares the affected code, though the vendor has not identified a way to exploit the vulnerability in PRA. Confirm the correct PRA patch with BeyondTrust Support. - Preserve evidence before any change or reboot on any appliance with signs of compromise. Mandiant's guidance, relayed by Rapid7, is to isolate suspected appliances and rebuild from a clean, fully patched image if compromise is confirmed or cannot be ruled out. Patching does not remove persistence. - Rotate stored and brokered credentials after patching or rebuilding, and review administrative changes and downstream sessions. Rapid7 states the credential and configuration review also applies to SaaS customers, whose instances BeyondTrust says were patched as of 2026-10-09. P2, within 72 hours: - Hunt the appliance logs under $BG\_app\_root/log/ and, on live workers, $BG\_app\_root/data/tmp/sdcust\_thin\_client//. The wrapper appends per-worker logs to the site log directory when the worker exits and clears the per-worker copies, so collect both locations during a live session. - Search httpd\_access.log for POST /api/start\_session followed by requests to a new, unfamiliar endpoint, and for the 200-then-404 pattern on the same extensionless path. Rapid7 is explicit that session creation alone is normal and a 200-then-404 is insufficient by itself; correlate with file changes, session records and unusual outbound connections. - Search for unexpected PHP files under the site's public directory and for receive files ending in .php.n$t. An interrupted transfer can leave the temporary file even when the final URL returns 404\. The .n$t suffix also occurs in normal transfers, so context is required. - Review thin-scc.log and thin-scc-errors.log in the proc{LocalFileTransfer} context. A DISCARDING NONLOCAL MESSAGE entry is evidence of an attempted invocation, not a successful upload; a successful exploit need not leave one. The empty-address errors 0:0:0 depend on how the exploit request is constructed and another implementation may leave different traces. - Hunt for unrecognised administrative sessions originating from residential broadband or commercial VPN addresses, and for shells spawned by web processes, per BeyondTrust's hunting guidance as summarised by Rapid7. P3, within 7 days: - Confirm whether brain.ini and thin-scc.ini have debug output enabled. Rapid7's captured configurations had enabled=0 and no debug log was captured. Brain's debug configuration limits MRS\_\* categories to Info, so enabling debug output alone will not guarantee detailed message payloads. Do not present names such as UploadFileStarted and DownloadFileEnded as default audit events; Rapid7 did not find them in collected logs. - Add the detection rules in §6 to appliance log ingestion and to endpoint monitoring for the appliance host. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IP addresses, file paths of malware) are present in the source material. The Rapid7 analysis provides log-line artefacts and behavioural patterns only. The IP addresses in its log excerpts (192.168.1.68, 192.168.1.98) are lab addresses and are not indicators. Behavioural indicators: | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- | | Two POST /api/start\_session requests in quick succession from one client, followed by a request to a new unfamiliar endpoint | httpd\_access.log | Medium; session creation is normal activity, the sequence is not conclusive alone | | Extensionless request returning 200 followed by 404 on the same path (payload executed then self-deleted) | httpd\_access.log | Medium; Rapid7 states this pattern is insufficient by itself | | Direct .php request returning 404 while the extensionless equivalent returns 200 | httpd\_access.log | Medium; detection that only searches for .php requests will miss the successful request | | New PHP files under the site's public directory, or receive files ending in .php.n$t | Appliance filesystem, $BG\_app\_root/app/www/public | Medium; .n$t also occurs in normal transfers | | DISCARDING NONLOCAL MESSAGE entries naming DownloadAnonymousFiles or UploadFiles with ftsName=local and an absolute path | thin-scc-errors.log | Medium; indicates an attempt, not a success | | MRS\_STREAM createStream to an internal mailbox followed by nodeID not found and failed to create a mailbox for sending to: 0:0:0 | thin-scc.log, proc{LocalFileTransfer} context | Medium; depends on exploit construction | | Customer connections from an external address recorded by brain around the same time | brain.log, BRN\_LSTN received fd entries with remoteIPAddress | Low on its own; customer connections are normal activity | | Unrecognised administrative sessions from residential broadband or commercial VPN addresses; shells spawned by web processes | Remote Support admin session records, endpoint telemetry on the appliance host | Medium; vendor hunting guidance relayed by Rapid7 | ## 6\. Detection The sources give usable log artefacts for Sigma. No file artefacts (hashes, strings inside a malicious binary) are present, so no YARA rule is emitted. ```yaml title: BeyondTrust Remote Support MRS origin forgery file transfer id: 7c1e4a92-3b6d-4f18-9a2e-5d0c8b1f6e34 status: experimental description: Detects thin-scc file-transfer log entries consistent with CVE-2026-102764 origin forgery, where an anonymous customer session reaches the native local filesystem provider and writes to an absolute path. author: Adverse Trace date: 2026-10-30 references: - https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764 logsource: product: beyondtrust service: remote_support detection: selection_action: message|contains: - 'LocalFileTransfer:action=DownloadAnonymousFiles' - 'LocalFileTransfer:action=UploadFiles' selection_provider: message|contains: 'ftsName=local' selection_path: message|contains: 'path=/' condition: selection_action and selection_provider and selection_path falsepositives: - Legitimate representative-initiated file transfers through the native provider level: high ``` ```yaml title: BeyondTrust Remote Support MRS empty reply-address error after file transfer id: 2f8b6d10-9c47-4e21-b3a5-6e1d0c7a4b58 status: experimental description: Detects the thin-scc sequence where a file-transfer handler starts a transfer then fails to create a mailbox for an empty 0:0:0 reply address, as produced by the Rapid7 exploit construction. author: Adverse Trace date: 2026-10-30 references: - https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764 logsource: product: beyondtrust service: remote_support detection: selection_stream: message|contains: 'proc{LocalFileTransfer}' selection_mailbox: message|contains: 'failed to create a mailbox for sending to: 0:0:0' condition: selection_stream and selection_mailbox falsepositives: - Other exploit implementations or malformed client requests that omit responseAddress level: medium ``` ```yaml title: BeyondTrust Remote Support extensionless PHP execution after public session start id: 5a3c9e72-1d84-4b60-8f27-0c9e6a2d7f13 status: experimental description: Detects the access-log pattern of a public session start followed by an extensionless request that returns 200 and then 404 on the same path, consistent with an uploaded PHP payload executing and self-deleting. author: Adverse Trace date: 2026-10-30 references: - https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764 logsource: category: webserver detection: selection_session: cs-method: 'POST' cs-uri-stem: '/api/start_session' sc-status: 200 selection_exec: cs-method: 'GET' sc-status: 200 selection_cleanup: cs-method: 'GET' sc-status: 404 condition: selection_session and selection_exec and selection_cleanup timeframe: 5m falsepositives: - Normal session creation followed by unrelated 404s; correlate on identical cs-uri-stem for the 200 and 404 level: medium ``` The third rule needs correlation on the same cs-uri-stem for the 200 and 404 events; most SIEMs require a join or a stateful rule to enforce that, and the raw Sigma above will over-alert without it. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-102764](https://nvd.nist.gov/vuln/detail/CVE-2026-102764?ref=f4n6.co.uk) | 9.3 Critical | ⚠ KEV 2026-10-16 | 19% | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately… | ## 7\. Sources - Rapid7, "Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)", https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764, 2026-10-30. - Rapid7, "CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild", https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild, 2026-10. - NVD / CISA KEV, CVE-2026-102764, https://nvd.nist.gov/vuln/detail/CVE-2026-102764, KEV added 2026-10-16, due 2026-10-19. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-102764 as CVSS 9.3 critical, in CISA KEV since 2026-10-16 with the remediation due date of 2026-10-19 already passed, and EPSS at 19%. The KEV listing and the vendor's confirmation of pre-disclosure exploitation mean this is not a patch-on-next-cycle item. The ARMORY CASTLE attribution rests on Mandiant's investigation as relayed by Rapid7 and has no MITRE ATT&CK profile in our data, so we treat it as unconfirmed; the post-exploitation chain (SAWFLY, BARECLAW, root escalation, credential-vault extraction, log deletion) is single-sourced and should be verified against a client's own appliance evidence before it drives scoping. For EMEA financial services clients, the exposure is a support appliance that sits in the administrative path to the estate, and a compromise dated to 2026-08-29 means the DORA Art. 19 reporting clock is already running for any affected firm. We will contact clients running self-hosted Remote Support to confirm BT26-05-RS status and PRA patch status, request the log locations in §4 for review, and reissue this advisory if BeyondTrust publishes fixed-build detail or Mandiant publishes atomic indicators. --- [Read the original source →](https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*