CVE-2026-102764 (CVSS 9.3): BeyondTrust Remote Support Now Has a Public Metasploit Exploit — Patch BT26-05-RS Now

Imagine your company’s most trusted remote-support tool — the software your IT desk uses to fix endpoints, troubleshoot servers, and assist users — quietly handing an unauthenticated attacker full operating-system command execution. That is exactly what CVE-2026-102764 does to BeyondTrust Remote Support, and as of October 30, 2026, Rapid7 has published a working Metasploit module that turns the exploit into a point-and-click operation. If your organisation runs a self-hosted BeyondTrust appliance and has not applied patch BT26-05-RS, you are one network scan away from a confirmed breach.

What Is CVE-2026-102764 and Why Should Your SOC Care?

BeyondTrust Remote Support is an enterprise-grade privileged access tool widely deployed in help desks, NOC/SOC environments, and managed-service operations across banking, healthcare, and critical infrastructure. It enables technicians to remotely access, diagnose, and remediate endpoints — often with elevated administrative privileges. That privileged footprint is precisely what makes this flaw so dangerous.

The vulnerability is classified as CWE-290: Authentication Bypass by Spoofing. At its core, the flaw exists in how BeyondTrust validates the origin of an internal message. An unauthenticated attacker — someone with no account on your system whatsoever — can forge the source router ID field in a specially crafted network request. This tricks an internal worker process into treating the attacker’s request as if it originated from the local appliance itself, granting access to a native file-transfer service that is normally internal-only.

From there, the attack chain is clean and rapid: the attacker uploads a PHP web shell to the web root directory and gains operating-system command execution running as the application’s OS user (UID 1000 in Rapid7’s testing environment). The entry point is the public customer connection port used to initiate support sessions — meaning the attack surface is anything exposed to the internet.

Rapid7 confirmed this chain against Remote Support version 24.1.2, build 1524046, and notes that all versions ≤ 26.2.3 are affected according to BeyondTrust’s own advisory BT26-05.

The Exploit Chain: A Technical Breakdown

For defenders and incident-response teams, understanding the mechanics is essential for writing detection rules and hunting in logs.

Stage	What Happens	Defensive Signal
1. Reconnaissance	Attacker identifies exposed BeyondTrust appliance via port scan or Shodan/Censys	Unusual scanning traffic on support connection ports
2. Spoofed Header	Forged source router-ID header sent via public customer connection endpoint	Anomalous router-ID values in appliance logs; requests from untrusted IPs hitting internal worker endpoints
3. File Upload	Internal file-transfer service accepts PHP file and writes it to the web root	New PHP/script files in web root directories; unexpected write operations at OS level
4. RCE via Web Shell	Attacker GETs the uploaded PHP file to execute arbitrary OS commands as app user	Unusual outbound connections from appliance; process spawning from web-server parent process; anomalous shell invocations
5. Post-Exploitation	Privilege escalation, credential harvesting, lateral movement to managed endpoints	Unexpected admin sessions; new privileged accounts; data staged for exfiltration

The stealth potential here is high. Because BeyondTrust is your privileged-access tool, an attacker operating through a web shell on the appliance already has a plausible explanation for every connection they initiate to managed endpoints. Without careful log correlation, this can look like normal IT activity.

ARMORY CASTLE: A China-Nexus Actor Already Inside

Google’s Threat Intelligence team has attributed active exploitation of CVE-2026-102764 to a threat actor it tracks as ARMORY CASTLE. The group exploited this vulnerability before any patch existed, beginning August 29, 2026 — a full seven weeks before CISA added the CVE to its KEV catalog and more than a month before BeyondTrust published its advisory.

ARMORY CASTLE targeted both a BeyondTrust-hosted cloud instance and a self-hosted on-premises appliance, demonstrating the group’s capability to reach targets regardless of deployment model. The China-nexus attribution carries particular relevance for Indian enterprises: state-sponsored Chinese actors have consistently targeted South Asian financial institutions, critical infrastructure, and defence supply chains.

Mandiant’s guidance on this campaign contains a sobering note: “upgrading closes the vulnerability but does not remediate prior exposure.” In practice, this means any appliance that was internet-accessible between August 29 and the date your patch was applied must be treated as potentially compromised until a full forensic investigation clears it. For organisations with BeyondTrust deployed in managed-service or outsourced IT contexts, this obligation extends to your service provider as well.

This pattern mirrors the ARTEX campaign we covered earlier, where China-linked actors exploited a remote-management tool (ConnectWise) to pivot through managed-service providers into thousands of downstream targets. The playbook is the same: compromise the tool that manages everything, and everything is compromised.

The Metasploit Effect: Why the Risk Just Escalated for Unpatched Appliances

When BeyondTrust initially disclosed the vulnerability and CISA added it to the KEV catalog, successful exploitation still required hand-crafted tooling — a non-trivial barrier that kept casual attackers at bay. That barrier evaporated on October 30, 2026, when Rapid7 submitted a working Metasploit module to the metasploit-framework repository.

Metasploit is free, widely used by both professional pentesters and opportunistic threat actors, and its module system makes exploitation a matter of setting a target IP and pressing enter. The security community’s convention is to withhold weaponised exploits until patches are broadly available; Rapid7 followed that convention — the SaaS patch shipped October 9 and the self-hosted patch followed shortly after. But any self-hosted appliance that has not yet applied BT26-05-RS is now trivially exploitable by anyone who can reach its network port.

This is the same dynamic we saw with the Cisco ASA SSL-VPN zero-day earlier this year: the window between initial disclosure and weaponised public exploitation compressed rapidly, and organisations that delayed patching by even a week after the Metasploit release faced dramatically elevated risk. History is repeating.

What You Should Do Right Now

This is not a “patch within 30 days” situation. If you run BeyondTrust Remote Support, the following actions are urgent — treat them as a weekend project, not a quarterly task.

Immediate Actions (0–48 hours)

1. Determine your deployment model. SaaS customers were patched by BeyondTrust on October 9, 2026 — verify this with your vendor. Self-hosted operators must act immediately.
2. Check your version. All versions ≤ 26.2.3 are affected. Log into your appliance admin interface and confirm your build number.
3. Apply BT26-05-RS. The patch covers versions 24.3.1 through 26.2.3. If your installation is older than 24.3.1, you must upgrade to a supported version before applying the patch — the patch cannot be applied directly to older builds.
4. Firewall your appliance. If you cannot patch immediately, restrict access to the customer connection port to known IP ranges only. This is a mitigation, not a fix — patch as soon as possible.

Forensic Investigation (run in parallel with patching)

1. Audit web root directories for unexpected PHP or script files deposited since August 29, 2026.
2. Review appliance OS-level process logs for shell processes spawned by the web-server parent — particularly bash, sh, curl, or wget children.
3. Examine outbound network connections from the appliance for anomalous destinations, especially to infrastructure in unexpected geographic locations.
4. Audit privileged sessions initiated from the appliance: look for sessions to endpoints that were never part of normal support workflows.
5. If you find evidence of compromise, do not simply patch and move on. Isolate the appliance, preserve forensic images, and engage incident response. Credential rotation for any account the appliance could reach is mandatory.

Strategic (Zero-Trust) Posture

This incident illustrates a fundamental zero-trust principle that is easy to overlook: your security tooling is part of your attack surface. PAM and remote-support tools are high-value targets precisely because they are trusted by design. In a mature zero-trust architecture, even privileged-access infrastructure must be:

• Placed behind micro-segmentation — not directly internet-exposed
• Subject to the same patch-SLA discipline as production workloads
• Monitored with anomaly detection, not just perimeter rules
• Governed by least-privilege: the BeyondTrust appliance should not have domain-admin credentials stored in it unless operationally unavoidable

Frequently Asked Questions

How do I know if my BeyondTrust appliance has already been compromised?

Indicators of compromise (IoCs) for the ARMORY CASTLE campaign have not been publicly released in full, but common signs of web-shell presence include unexpected PHP files in the application web root, anomalous child processes spawned from the web server (especially reverse-shell patterns), and outbound connections to unfamiliar IP addresses or domains from the appliance OS. Run a file-integrity check against a known-good baseline for your build version, and review system and access logs going back to August 29, 2026. If you do not have logs from that period, treat the appliance as potentially compromised and conduct a full forensic review.

Our BeyondTrust instance is behind a VPN — are we still at risk?

You are at lower risk than an internet-exposed appliance, but not zero risk. The attack exploits the customer connection port — the port that support sessions originate from. If that port is only reachable from internal networks, an attacker would first need lateral access to your network before exploiting this vulnerability. However, if any VPN split-tunnelling allows external devices to reach the appliance, or if the port is exposed on a separate interface, the risk remains real. Patch regardless of your network topology — defence-in-depth means not relying on network controls alone.

Is this the same as the BeyondTrust vulnerability from December 2024?

No. BeyondTrust had a separate critical vulnerability (CVE-2024-12356) in late 2024 that affected the Command Injection path and was also exploited by state-sponsored actors. CVE-2026-102764 is a distinct flaw — an origin-validation bypass introduced in a different code path. If you patched the 2024 vulnerability, you are not protected against this one. Check that BT26-05-RS has been applied specifically.

What does ARMORY CASTLE typically do after gaining access?

Google Threat Intelligence’s attribution to ARMORY CASTLE suggests a China-nexus espionage motivation — the group’s typical objectives include credential harvesting, intellectual-property theft, and persistent access for long-term surveillance. Remote-support tools are particularly attractive because the attacker can appear to be a legitimate support technician once they control the appliance, making detection via session monitoring alone unreliable. The group is known to be patient: they establish persistence, move laterally quietly, and exfiltrate data over extended periods. This is not a smash-and-grab ransomware operator — the footprint may be subtle and old by the time it’s discovered.

Act Before the Weekend Is Over

CVE-2026-102764 combines every factor that makes a vulnerability genuinely dangerous: critical CVSS score, zero-day exploitation by a sophisticated nation-state actor, CISA KEV listing, and now a public Metasploit module. The attack requires no credentials and no user interaction. If your BeyondTrust Remote Support appliance is internet-accessible and unpatched, it is not a matter of if but when — and given the Metasploit module’s release, “when” may be measured in hours.

Patch BT26-05-RS today. Investigate for prior compromise regardless. And take a hard look at whether your privileged-access infrastructure deserves the same zero-trust principles you apply to your production workloads.

Have questions about assessing your BeyondTrust exposure, conducting a post-compromise investigation, or building a zero-trust architecture that protects your privileged-access tools? Request a security assessment from Sanjay Seth — with three decades of enterprise security experience across India’s largest organisations, we can help you move from vulnerable to verified.