EIP-2026-104186

PRE-CVE

BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104186. PoCs published by Malcrove.

AI-analyzed exploit summary This is a technical writeup detailing an unauthenticated reflected XSS vulnerability in BeyondTrust Remote Support 6.0 and earlier versions. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the login[password] parameter in the /appliance/login endpoint.

Description

BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

Exploits (1)

exploitdb WRITEUP
by Malcrove · textwebappsmultiple
https://www.exploit-db.com/exploits/50632

This is a technical writeup detailing an unauthenticated reflected XSS vulnerability in BeyondTrust Remote Support 6.0 and earlier versions. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the login[password] parameter in the /appliance/login endpoint.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: BeyondTrust Remote Support v6.0 and earlier
No auth needed
Prerequisites: Access to the target's /appliance/login endpoint
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026