Rapid7 has published a full technical analysis and a working Metasploit module for CVE-2026-102764, the BeyondTrust Remote Support flaw that attackers were already exploiting before the vendor disclosed it. The November 1 release puts a ready-made exploit in the hands of anyone running the open-source framework.
What the Rapid7 Metasploit Module Does Against Remote Support Appliances
CVE-2026-102764 is rated 9.3 on the CVSS v4 scale. An unauthenticated attacker can write files on a BeyondTrust Remote Support appliance and run code as the site’s operating system user. The Metasploit module covers two targets, PHP and Unix Command.
Rapid7’s analysis explains the root cause. An attacker places a reserved local router ID in the source address of a message. The router forwards it, and the worker process accepts the address as proof that the message came from a local origin. The router includes an anti-spoofing check, but the bypass defeats it.
The Spoofed Router ID That Defeats the Anti-Spoofing Check
The weakness is a trust problem between two components. The worker treats a source address as evidence of where a message started, and the router lets a forged local identifier through. The attacker never needs credentials, which is why the flaw is exploitable without authentication.
BeyondTrust Confirmed Exploitation Before the Flaw Was Disclosed
BeyondTrust confirmed attacks before disclosure, with two known compromises dated August 29. One involved a BeyondTrust-hosted environment and one a self-hosted appliance. Mandiant attributes the exploitation to ARMORY CASTLE, a suspected PRC-nexus group formerly tracked as UNC5221.
The vendor shipped a fix as patch BT26-05-RS. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16 with a remediation deadline of October 19, and Canada’s Cyber Centre issued its own alert.
Earlier Remote Support Entries in the CISA Catalog
This is not the first Remote Support product flaw to reach the KEV catalog. CVE-2024-12356, CVE-2024-12686 and CVE-2026-1731 were listed earlier. A recurring pattern of exploited bugs in the product means defenders already treat the appliance as a high-value target for edge access.
Why a Public Module Raises the Risk for Unpatched Appliances
A Metasploit module removes the research step that previously separated a determined group from a broader set of attackers. Before the release, exploiting the flaw required reproducing the router ID trick from scratch. Now the work is packaged for the framework that penetration testers and criminals both use. Mass exploitation risk rises for appliances that have not applied BT26-05-RS, particularly self-hosted installations where the customer controls updates.
Rapid7’s module targets the two code paths named in its analysis, PHP and Unix Command. Both give the attacker code execution as the site’s operating system user rather than as a higher-privileged account, so the immediate foothold is the appliance’s own service context. Remote Support appliances sit at the boundary between support staff and the endpoints they manage. Mandiant attributes the earlier exploitation to ARMORY CASTLE.
The earlier ARMORY CASTLE coverage focused on the zero-day exploitation. The Metasploit release is a separate development: it moves the flaw from use by a single suspected state-linked group into a public tool, while the federal remediation deadline of October 19 has already passed.
The disclosure timeline shows how long the flaw has been in play. The first known compromises date to August 29, BeyondTrust and CISA acted in mid-October, and Rapid7 followed on November 1. Rapid7’s technical analysis names the specific mechanism, a spoofed reserved local router ID, rather than only describing the outcome, which lets defenders reason about detection as well as patching.
The module’s two targets also set the practical limits of the release. Rapid7 rates the flaw 9.3 on CVSS v4, and the exploit does not need credentials, but it reaches the appliance only where the vulnerable service is reachable. Organizations with hosted Remote Support environments depend on BeyondTrust to have applied the fix, while those with self-hosted appliances must apply BT26-05-RS themselves.
