Rapid7 finds file-upload flaw in BeyondTrust Remote Support enabling code execution

Rapid7 researchers found that an unauthenticated file-upload flaw in BeyondTrust Remote Support lets attackers upload files without authentication and run code as the appliance operating system.

Hacktron estimated that about 11,000 instances of the software face the internet. Roughly 8,500 of them run on-premises and may remain unpatched.

BeyondTrust said on Feb. 9, 2026, that it knew of no active exploitation of CVE-2026-1731. The vendor said successful exploitation could permit an unauthenticated remote attacker to run operating system commands as the site user, potentially leading to system compromise, data exfiltration, or service disruption. “Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user,” BeyondTrust said.

By Feb. 13, 2026, security researchers reported active exploitation of CVE-2026-1731 against internet-facing BeyondTrust Remote Support and Privileged Remote Access systems. On February 10, Rapid7 published a technical write-up and proof-of-concept code for CVE-2026-1731. Defused and GreyNoise found widespread reconnaissance and limited exploitation of the flaw. Defused saw exploit attempts based on the Nuclei script and no other variants.

GreyNoise saw a surge in scanning and reconnaissance on Feb. 11, mainly from one IP linked to a known scanning operation. Most scans skipped the standard HTTPS port 443 and probed non-standard port clusters instead. GreyNoise said this reflects organizations moving BeyondTrust away from default ports for security-through-obscurity.

Arctic Wolf detected CVE-2026-1731 attacks and observed SimpleHelp RMM deployment attempts used for persistence along with discovery and lateral movement. Darktrace shared indicators of anomalous activity and post-exploitation behavior that could indicate compromise.

Ryan Dewhurst of watchTowr said attackers misuse get_portal_info to get the x-ns-company value before opening a WebSocket channel. “Attackers are abusing get_portal_info to extract the x-ns-company value before establishing a WebSocket channel,” Dewhurst said.

The flaw fits a pattern of remote-support tools being targeted as high-value access points. In an earlier intrusion, a stolen API key helped attackers compromise 17 Remote Support SaaS instances following a BeyondTrust breach involving CVE-2024-12356 and CVE-2024-12686. BeyondTrust patched a high-severity Server-Side Template Injection flaw in June 2025.

CVE-2026-1731 involves the get_portal_info endpoint, the same endpoint used by CVE-2024-12356. GreyNoise called the flaw a variant of CVE-2024-12356 that uses the same WebSocket endpoint through a different code path.

In 2024, Chinese state-backed hackers known as Silk Typhoon used two BeyondTrust zero-day bugs to breach the U.S. Treasury Department. The same actors also targeted CFIUS and OFAC. CISA listed CVE-2024-12356 in its Known Exploited Vulnerabilities catalog on Dec. 19 and ordered federal agencies to secure their networks within a week.

BeyondTrust secured all cloud-based Remote Support and Privileged Remote Access systems by Feb. 2, 2026. BeyondTrust secured cloud systems before urging on-premises remediation. Vulnerable releases include Remote Support 25.3.1 or earlier and Privileged Remote Access 24.3.4 or earlier.

Attackers can write files to the appliance and execute code without logging in or interacting with a user. Rapid7 tested Remote Support version 24.1.2, build 1524046, revision 4208-ddcf90715106aa0c0e19c103f8d2c412af4beff3. The test appliance had thin chat enabled by default and also allowed public issue-menu session starts.

Customers can start anonymous sessions through POST /api/start_session. The call returns two customer keys that do not identify a logged-in account. A wrapper checks the session key against an unexpired sdcust record before starting the appliance-side worker. A thin session for an anonymous customer still runs a worker that trusts forged local source addresses.

Researchers put a PHP payload in the public web directory and triggered it through an extensionless URL, running code as the site user. The module runs code as msfuser with UID 1000 on the tested appliance. Researchers used the native service to read /proc/self/environ and locate the installation path before deploying the payload.

An attacker can put the reserved local router alias 1 into a message source address, tricking the appliance into treating a network request as local. The message router forwards packets while leaving the source claim that the worker’s local-origin check relies on. In app/brain, the local-address predicate comes back true when the node matches and the router is 1 or the real local router.

The thin-scc component passes the sender address to the router object’s local-address predicate for evaluation. The native filesystem provider that the exploit uses carries the name local. Attackers can upload to an absolute path on the appliance since the service accepts an absolute destination path and skips directory traversal. The loop that receives files opens the destination path, writes incoming data, and renames a temporary file to the final destination.

BeyondTrust’s identity security customer base exceeds 20,000 organizations in more than 100 countries and includes 75% of Fortune 100 firms. Remote Support lets IT teams troubleshoot remotely, and Privileged Remote Access acts as a secure gateway enforcing authorization rules for selected systems and resources. On-premises customers must patch manually to Remote Support 25.3.2 or later and Privileged Remote Access 25.1.1 or later if automatic updates are not enabled. Groups that did not patch CVE-2026-1731 should assume compromise and investigate.