{"id":"CVE-2026-102764","kind":"vulnerability","aliases":["CVE-2026-102764"],"related":[],"title":"beyondtrust remote support: The vulnerability exists within internal components of BeyondTrust’s Remote Support product","description":"BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Improper origin validation (CWE-290) in an internal messaging component of BeyondTrust Remote Support lets an unauthenticated remote attacker perform file operations, including arbitrary file upload, on the appliance. CVSSv4 9.3. Exploited in the wild since 2026-08-29 (Mandiant: SAWFLY web shell, BARECLAW tunneler, root escalation). In CISA KEV since 2026-10-16. SaaS was patched 2026-10-09; self-hosted appliances need the patch applied. Self-hosted Privileged Remote Access shares the code; BeyondTrust has found no exploit path there but recommends patching.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-10-16T00:00:00+00:00","products":[{"name":"BeyondTrust Remote Support","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"BeyondTrust Remote Support","fixed":["BT26-05-RS patch (v24.3.1 - v26.2.3)"],"affected":"<= 26.2.3 without BT26-05-RS patch","ecosystem":"vendor"},{"name":"beyondtrust remote support","fixed":[],"affected":"<= 26.2.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["beyondtrust","exploited","internet-facing","poc-public","remote-support","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Self-hosted: open the /appliance interface and confirm the BT26-05-RS patch is installed, and check the RS version (all versions <= 26.2.3 are affected without the patch). Hunt for unrecognized admin sessions from residential or VPN IPs, unexpected scripts in web directories, changes to Jump Items or Teams, log-forwarding gaps, mangoapi.php, ingredi_ws, /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, and a /uidchanarge route in /ns/config/haproxy.conf. Rapid7 and Nexpose have an authenticated check.","fix":"Apply the BT26-05-RS patch (for RS 24.3.1 to 26.2.3) in the /appliance interface. Instances older than 24.3.1 must upgrade first, then patch. Patching does not remove persistence: preserve evidence, isolate, rebuild from a clean patched image if compromise cannot be ruled out, and rotate stored credentials. Forward appliance logs to an external SIEM.","status":"resolved","published_at":"2026-10-15T21:17:00+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:49:55+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T19:49:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per BeyondTrust's advisory; the sources do not name the fixed version. Follow CISA BOD 26-04 guidance and forensics triage steps if exposed.","summary":"BeyondTrust Remote Support has an authentication bypass by spoofing flaw that lets a remote attacker perform file operations on the appliance without valid credentials. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["beyondtrust","remote-support","self-hosted","internet-facing"],"confidence":0.7,"analyst_note":"Find affected and fixed versions and the vendor mitigation in the BeyondTrust advisory linked from the CISA KEV entry (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.0004,"input_tokens":2236,"output_tokens":353,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed versions and the vendor mitigation in the BeyondTrust advisory linked from the CISA KEV entry (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764).","search":"'-04':173C,199C,230C '-08':83B '-09':105B '-10':98B,104B '-102764':18A,21A '-16':99B '-2026':17A,20A '-29':84B '-290':50B '2026':82B,97B,103B '26':172C,198C,229C '9.3':76B 'access':119B 'accord':162C 'action':158C 'adher':226C 'allow':145C 'appli':113B,159C 'applianc':74B,109B,155C 'applic':196C 'arbitrari':69B 'asset':220C 'attack':64B,148C 'authent':138C 'bareclaw':89B 'base':177C 'beyondtrust':1A,11A,22A,25A,28A,31B,57B,123B,133C 'bod':171C,197C,228C 'bypass':139C 'cisa':94B,156C,169C,186C 'cloud':202C 'code':122B 'complianc':167C 'compon':9A,55B 'contain':136C 'could':144C 'cve':16A,19A 'cvssv4':75B 'cwe':49B 'discontinu':205C 'ensur':166C,225C 'escal':92B 'evalu':218C 'exist':6A 'exploit':32B,77B,127B 'exposur':223C 'face':35B 'file':66B,70B,151C 'follow':195C 'forens':188C 'found':125B 'guidanc':184C,200C 'guidelin':232C 'host':44B,108B,116B 'improp':46B 'includ':68B 'instruct':165C 'intern':8A,53B 'internet':34B,222C 'internet-fac':33B 'kev':95B 'let':60B 'mandiant':85B 'messag':54B 'mitig':160C,211C 'need':110B 'note':183C,194C 'oper':67B,152C 'origin':47B 'patch':102B,112B,132B,231C 'path':128B 'perform':65B,150C 'poc':37B 'poc-publ':36B 'priorit':174C 'privileg':117B 'product':15A,209C 'public':38B 'recommend':131B 'remot':2A,13A,40B,58B,63B,118B,134C,147C 'remote':23A,26A,29A 'remote-support':39B 'requir':157C,190C 'respons':216C 'risk':179C 'root':91B 'saa':100B 'sawfli':86B 'secur':175C 'see':180C,191C 'self':43B,107B,115B 'self-host':42B,106B,114B 'servic':203C 'share':120B 'shell':88B 'sinc':81B,96B 'spoof':141C 'stakehold':214C 'support':3A,14A,24A,27A,30A,41B,59B,135C 'triag':189C 'tunnel':90B 'unauthent':62B 'unavail':213C 'updat':176C 'upload':71B 'url':181C,192C 'use':206C 'valid':48B 'vendor':45B,164C 'vulner':5A,142C 'web':87B 'wild':80B 'within':7A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T21:17:00+00:00","kev":{"dateAdded":"2026-10-16","dueDate":"2026-10-19","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"13061848-ea10-403d-bd75-c83a022c2891","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-102764","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764","severity":null,"published_at":"2026-10-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T15:39:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-102764:102","url":null,"severity":null,"published_at":"2026-10-23T21:33:50+00:00","modified_at":"2026-10-23T21:33:50+00:00","first_seen_at":"2026-10-23T21:33:50+00:00","fetched_at":"2026-10-23T21:33:50+00:00","note":"Read BeyondTrust BT26-05 (primary) and Rapid7 analysis. Exploited since Aug 29 2026 (ARMORY CASTLE per Mandiant). No public PoC found; social chatter not searched."},{"source":"nvd","external_id":"CVE-2026-102764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","severity":null,"published_at":"2026-10-15T21:17:00+00:00","modified_at":"2026-10-17T04:16:47+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"github-poc","external_id":"CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check","url":"https://github.com/CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check","severity":null,"published_at":"2026-10-23T23:42:55+00:00","modified_at":null,"first_seen_at":"2026-10-23T23:55:02+00:00","fetched_at":"2026-10-23T23:55:02+00:00","note":null}],"documents":[{"id":1097,"url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","title":"BeyondTrust BT26-05","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1098,"url":"https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild","title":"Rapid7: CVE-2026-102764 exploited in the wild","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2250,"url":"https://github.com/CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check","title":"CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check","kind":"poc","source":"github","text":"Standalone defensive checker project for CVE-2026-102764: BeyondTrust Remote Support: Internal-message origin validation / unauthorized file operations. One exploit per repository; implementation pending.\n\nstars 0","published_at":"2026-10-23T23:42:55+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}