BeyondTrust Remote Support EUVD-2026-102427

Exploitation targets internal components of BeyondTrust Remote Support that fail to validate the origin of received messages (CWE-290); an attacker must be able to deliver messages to that internal messaging path and successfully spoof a trusted source so the appliance accepts attacker-supplied file operations. The description's phrase 'under the right conditions' explicitly signals that exploitation is not unconditional - the attacker likely needs network reachability to the specific internal component and the ability to craft messages matching the expected trusted origin. The CVSS vector states PR:N/UI:N (no authentication, no user interaction) against a network vector, but the 'right conditions' limiter means defenders should assume network segmentation, exposure of the internal interface, and appliance version are the practical gating factors rather than raw remote reachability.

This is a credible high-priority issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity vulnerability with high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H), scored 9.3. The root cause is CWE-290 (Authentication Bypass by Spoofing) - the product fails to validate the origin of internal messages, which aligns with the authentication-bypass class and the network attack vector. However, several signals temper the raw score: no EPSS probability was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is indicated in the supplied references. Critically, the description's qualifier 'under the right conditions' is in tension with the vendor's AC:L rating - a low-complexity claim implies no special preconditions, yet the wording suggests the attacker must reach or spoof a specific internal component, which points toward added complexity. Verify the exact preconditions with BeyondTrust advisory BT26-05 before treating this as trivially exploitable. Given no confirmed active exploitation and no public exploit, this is a patch-urgently-but-not-yet-weaponized item; BeyondTrust products have historically drawn active exploitation (e.g., prior Remote Support CVEs reached KEV), so monitor KEV closely.

A remote attacker who can reach the BeyondTrust Remote Support appliance's network interface sends messages crafted to appear as if they originate from a trusted internal component. Because the appliance does not adequately validate message origin, the attacker is treated as authorized and can perform file operations (read/write/delete) on the appliance. No public exploit code is identified at time of analysis, but the unauthenticated network vector makes weaponization plausible if preconditions are met.