Rapid7 shows unauthenticated file upload turning into code execution in BeyondTrust Remote Support
Researchers chained an origin-validation gap in the appliance's internal message router to write a PHP file into the public web directory, running code as the site user. CISA added the flaw to its known exploited vulnerabilities catalog.
Rapid7 published an analysis on Oct 30, 2026, describing how an origin-validation flaw in BeyondTrust Remote Support can be turned into unauthenticated remote code execution. The entry point is the public customer connection used to start a support session, so no credentials or user interaction are needed.
The bug sits between the appliance's internal message router, called brain, and a customer worker process, thin-scc. A message's source address can carry a reserved local router ID. The router forwards it, and the worker treats that address as proof the request came from a local component. That opens the internal file-transfer service, including its native filesystem provider.
Rapid7 confirmed a file write, then uploaded a PHP file to the site's public directory and requested it to get code execution as the site user. A Metasploit module now implements the chain. The researchers tested Remote Support 24.1.2, build 1524046, with public issue-menu session starts and thin chat enabled by default. They say other affected releases and fixed builds have not been established.
BeyondTrust's advisory describes the same weakness as inadequate validation of message origin, allowing file operations on the appliance. CISA added the flaw to its known exploited vulnerabilities catalog on Oct 16, 2026, with a remediation due date of Oct 19, 2026, and points administrators to vendor mitigations and its risk-based patching directive.
Defenders should treat internet-facing Remote Support appliances as exposed, check their build against vendor guidance, and review for unexpected files in web-accessible directories.
CVE references
Sources
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning