BeyondTrust Remote Support Critical Auth Bypass CVE-2026-102764 Exploited
Attackers bypassed authentication in BeyondTrust Remote Support to perform file operations, prompting CISA to add the flaw to its known exploited vulnerabilities list.
Key points
- CVE-2026-102764 allows unauthenticated remote file operations on BeyondTrust Remote Support appliances.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 16, 2026.
- BeyondTrust confirmed two compromises in August 2026, including one self-hosted and one hosted instance.
BeyondTrust disclosed a critical authentication bypass in its Remote Support platform on October 15, 2026. The vendor identified the flaw as CVE-2026-102764 and confirmed that attackers had already exploited it in the wild before the public announcement.
The vulnerability carries a CVSSv4 score of 9.3, classifying it as critical. It enables unauthenticated remote attackers to execute file operations on affected appliances without any user interaction. Rapid7’s first-hand research highlights the severity, noting that the flaw stems from inadequate validation of incoming message origins within internal components.
Context and Background
BeyondTrust reported two specific compromises dating back to August 29, 2026. One incident involved a BeyondTrust-hosted instance, which the vendor discovered and contained on September 28. The second compromise affected a self-hosted appliance. Mandiant shared corroborating findings from its investigation of the self-hosted breach on September 30.
Mandiant’s analysis linked the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor previously tracked as UNC5221. The attackers performed arbitrary file uploads, deployed the SAWFLY PHP web shell and the BARECLAW tunneler, and achieved root escalation. They also attempted to extract credentials from vaults, established persistence, and deleted logs to cover their tracks.
Who Is Affected
CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026. The agency set an October 19, 2026, due date for remediation and marked forensic triage as required. The flaw impacts Remote Support versions 26.2.3 and earlier, unless the BT26-05-RS patch has been applied.
BeyondTrust stated that all Remote Support SaaS customers were patched as of October 9, 2026. However, self-hosted deployments require manual action. The vendor also advised immediate patching for Privileged Remote Access (PRA) systems, as they share the affected code, though no exploitation method for PRA has been identified.
What should you do?
Rapid7 recommends remediating affected self-hosted appliances on an emergency basis, outside normal patching cycles. Organizations should investigate Remote Support appliances for prior compromise even after applying the fix. Mandiant advises preserving evidence before rebooting or making changes to suspected systems.
What to do and how to stay safe: BeyondTrust
- Check if your Remote Support version is 26.2.3 or earlier and apply the BT26-05-RS patch immediately.
- Investigate logs for unrecognized administrative sessions from residential broadband or commercial VPN addresses.
- Rotate stored or brokered credentials and review administrative changes after patching or rebuilding systems.
- Isolate suspected appliances and rebuild from a clean image if compromise cannot be ruled out.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-102764?
The vulnerability has been assigned a CVSSv4 score of 9.3, indicating a critical severity level.
Did BeyondTrust confirm that this vulnerability is being exploited?
Yes, BeyondTrust confirmed that exploitation in the wild occurred prior to disclosure, with two known compromises in August 2026.
Are SaaS customers affected by this vulnerability?
BeyondTrust stated that all Remote Support SaaS customers were patched as of October 9, 2026, but they should still review credentials and configurations.
