Internal components do not properly check where the messages they receive come from, so an outsider without a login can perform file operations on the appliance. CISA lists it as exploited.
What it allows
A remote attacker with no credentials and no user interaction can perform unauthorized file operations on an affected Remote Support appliance. The Canadian Cyber Centre says this can enable arbitrary file uploads and may result in full compromise of the appliance. CISA says actors are using the flaw for initial access, then persistence, privilege escalation and lateral movement. NVD lists CVSS v3.1 9.8 and CVSS v4.0 9.3, both Critical.
Who is affected
BeyondTrust Remote Support versions 26.2.3 and earlier are affected, per the NVD record and the Canadian Cyber Centre. The fix for self-hosted appliances running 24.3.1 up to 26.2.3 is the BT26-05-RS patch from BeyondTrust Security Advisory BT26-05. Appliances older than 24.3.1 must be upgraded first, then patched. Per CISA and the Canadian Cyber Centre, BeyondTrust-hosted (SaaS) Remote Support is already patched, and the Cyber Centre says the SaaS patch was applied as of 9 October 2026.
NVD published the record on 15 October 2026. CISA published its alert and added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 16 October 2026, with a due date of 19 October 2026. The KEV entry does not mark it as used in ransomware campaigns (field shows Unknown). CISA and the Canadian Cyber Centre name no actor. Google Threat Intelligence Group attributes the zero-day use to ARMORY CASTLE, a suspected China-nexus espionage group formerly tracked as UNC5221 (see the timeline).
Remote-access tools are not the only place authentication checks get skipped. CVE-2026-123549 lets an anonymous OpenAM self-registration bypass the allowed attribute list and reach an administrative group.
Timeline
- 9 Oct 2026
Per the Canadian Cyber Centre, the vendor had patched all Remote Support SaaS customers by this date.
- 15 Oct 2026
Vendor advisory BT26-05 released, and NVD published the CVE record.
- 15 Oct 2026
Google Threat Intelligence Group (Mandiant) published its report. It says Mandiant found evidence that the flaw was exploited as a zero-day in late August 2026, and attributes this to ARMORY CASTLE (formerly UNC5221), a suspected China-nexus espionage group that used the SAWFLY web shell. The group also used the BARECLAW tunneler. Attributed by Google Threat Intelligence Group; CISA and the Canadian Cyber Centre name no group.
- 16 Oct 2026
CISA published its alert and added the CVE to the KEV catalog. The Canadian Cyber Centre issued alert AL26-025.
- 19 Oct 2026
CISA KEV due date for federal agencies to apply mitigations.
Who exploits it
What to do
-
Patch self-hosted appliances
Apply the BT26-05-RS patch from BeyondTrust Security Advisory BT26-05 on versions 24.3.1 to 26.2.3. If you run a version older than 24.3.1, upgrade first, then patch. Confirm automatic updates are on.
-
Check how you are hosted
Find every Remote Support deployment and note whether it is SaaS or self-hosted, and which version it runs. SaaS deployments are already patched, per CISA.
-
Limit exposure
Allow outside access only to the services users need, and keep administrative interfaces on trusted networks.
-
Hunt for compromise
Look for unrecognized privileged or administrative sessions, unrecognized script files, gaps in logs or log forwarding, and unauthorized changes to accounts, permissions or session policies. Collect appliance, web application firewall, reverse proxy and perimeter firewall logs for the exposure window.
-
If you suspect compromise
Isolate the appliance and keep a snapshot or forensic image. Rebuild from a known-good state, apply the patch, rotate every credential the appliance stored or injected, revoke active support sessions and review new MFA registrations on privileged accounts.
Frequently Asked Questions
What is CVE-2026-102764?
It is an authentication bypass by spoofing (CWE-290) in BeyondTrust Remote Support. Internal components do not adequately validate the origin of messages they receive, which lets an attacker perform file operations on the appliance. NVD lists CVSS v3.1 9.8.
Which versions are affected and what is the fix?
Remote Support 26.2.3 and earlier. Self-hosted appliances on 24.3.1 to 26.2.3 need the BT26-05-RS patch. Older appliances must be upgraded first. SaaS deployments are already patched, per CISA.
Is CVE-2026-102764 exploited?
Yes. CISA says threat actors are actively exploiting it and added it to the KEV catalog on 16 October 2026, with a due date of 19 October 2026.
Sources
- CISA urges patching critical vulnerability in BeyondTrust Remote SupportCISA
- Known Exploited Vulnerabilities catalog entry for CVE-2026-102764CISA
- CVE-2026-102764 recordNIST NVD
- AL26-025 Critical vulnerability impacting BeyondTrust Remote Support (CVE-2026-102764)Canadian Centre for Cyber Security
- ARMORY CASTLE Exploits BeyondTrustGoogle Threat Intelligence Group (Mandiant)
