--- title: Rapid7 Analysis: Unauthenticated File Upload to RCE in... description: An origin-validation bug in BeyondTrust Remote Support lets an unauthenticated attacker write a file to the appliance and run code as the site's OS user. The... canonical: https://daily.dev/posts/rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764--s0rbygklv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) | daily.dev og:description: An origin-validation bug in BeyondTrust Remote Support lets an unauthenticated attacker write a file to the appliance and run code as the site's OS user. The... og:url: https://daily.dev/posts/rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764--s0rbygklv og:image: https://api.daily.dev/og/posts/S0rbYgKlv.png og:image:alt: Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 21 min read · 0 upvotes · 0 comments ## Summary An origin-validation bug in BeyondTrust Remote Support lets an unauthenticated attacker write a file to the appliance and run code as the site's OS user. The flaw lets an attacker forge a message's source router ID so an internal worker treats a network request as local, exposing a native file-transfer service. Rapid7 used this to upload a PHP file into the web root and get code execution, then a Metasploit module implementing the chain supports PHP and Unix command targets. Tested on Remote Support 24.1.2, build 1524046, exploitation ran as msfuser, UID 1000, with no credentials or user interaction required. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-102764 in BeyondTrust Remote Support and how does it lead to RCE? It is an origin-validation flaw where an unauthenticated attacker forges a message's source router ID so the appliance's thin-scc worker treats a network request as local, granting access to an internal file-transfer service. This lets an attacker upload a PHP file into the web document root and execute it, achieving code execution as the site's OS user with no credentials needed. _Teams patching BeyondTrust appliances can track vulnerability writeups like this on daily.dev._ ### Which BeyondTrust Remote Support version was confirmed vulnerable to the unauthenticated file upload RCE? Remote Support 24.1.2, build 1524046 (revision 4208-ddcf90715106aa0c0e19c103f8d2c412af4beff3) was confirmed vulnerable, with the underlying Secure Remote Access base appliance at version 7.1.0. Other affected releases and fixed builds had not been established at the time of testing, and the test appliance had default settings with public issue-menu session starts and thin chat enabled. _Admins deciding whether to patch now or wait can follow version-specific advisories on daily.dev._ ### What log entries indicate exploitation of the BeyondTrust thin-scc native file transfer vulnerability? Successful exploitation leaves lines in thin-scc.log showing createStream connecting to an attacker-controlled MRS address, followed by 'nodeID not found in node list even after renumerating' and 'failed to create a mailbox for sending to: 0:0:0' errors, since the exploit omits responseAddress. A rejected (negative control) attempt instead logs 'DISCARDING NONLOCAL MESSAGE' in thin-scc-errors.log naming the action, ftsName=local, and destination path. _Incident responders building detection rules can pull indicator breakdowns like these from daily.dev._ ## Similar posts on daily.dev - [BeyondTrust warns of critical flaws in remote access software](https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals) · BleepingComputer · 0 upvotes · 0 comments - [You’re Not Supposed To ShareFile With Everyone \(Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701\)](https://daily.dev/posts/you-re-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699--ejmivpr2z) · watchTowr Labs · 0 upvotes · 0 comments - [CVE-2026-1357: WordPress Plugin RCE Exposes Sites to Full Takeover](https://daily.dev/posts/cve-2026-1357-wordpress-plugin-rce-exposes-sites-to-full-takeover-fq2jk89o7) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764--s0rbygklv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)","url":"https://daily.dev/posts/rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764--s0rbygklv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764--s0rbygklv"},"datePublished":"2026-10-30T16:48:13.278Z","dateModified":"2026-10-30T17:13:55.529Z","description":"An origin-validation bug in BeyondTrust Remote Support lets an unauthenticated attacker write a file to the appliance and run code as the site's OS user. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a772c2654395fbfc9085d4a2b564c97?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a772c2654395fbfc9085d4a2b564c97?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764--s0rbygklv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability","timeRequired":"PT21M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764--s0rbygklv#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-102764 in BeyondTrust Remote Support and how does it lead to RCE?","acceptedAnswer":{"@type":"Answer","text":"It is an origin-validation flaw where an unauthenticated attacker forges a message's source router ID so the appliance's thin-scc worker treats a network request as local, granting access to an internal file-transfer service. This lets an attacker upload a PHP file into the web document root and execute it, achieving code execution as the site's OS user with no credentials needed. Teams patching BeyondTrust appliances can track vulnerability writeups like this on daily.dev."}},{"@type":"Question","name":"Which BeyondTrust Remote Support version was confirmed vulnerable to the unauthenticated file upload RCE?","acceptedAnswer":{"@type":"Answer","text":"Remote Support 24.1.2, build 1524046 (revision 4208-ddcf90715106aa0c0e19c103f8d2c412af4beff3) was confirmed vulnerable, with the underlying Secure Remote Access base appliance at version 7.1.0. Other affected releases and fixed builds had not been established at the time of testing, and the test appliance had default settings with public issue-menu session starts and thin chat enabled. Admins deciding whether to patch now or wait can follow version-specific advisories on daily.dev."}},{"@type":"Question","name":"What log entries indicate exploitation of the BeyondTrust thin-scc native file transfer vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Successful exploitation leaves lines in thin-scc.log showing createStream connecting to an attacker-controlled MRS address, followed by 'nodeID not found in node list even after renumerating' and 'failed to create a mailbox for sending to: 0:0:0' errors, since the exploit omits responseAddress. A rejected (negative control) attempt instead logs 'DISCARDING NONLOCAL MESSAGE' in thin-scc-errors.log naming the action, ftsName=local, and destination path. Incident responders building detection rules can pull indicator breakdowns like these from daily.dev."}}]} ```