--- id: "CVE-2026-102764" kind: "vulnerability" aliases: ["CVE-2026-102764"] title: "beyondtrust remote support: The vulnerability exists within internal components of BeyondTrust\u2019s Remote Support product" severity: "critical" cvss: 9.8 epss: null exploited: true status: "resolved" category: "vendor" products: [{"name": "BeyondTrust Remote Support", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "BeyondTrust Remote Support", "fixed": ["BT26-05-RS patch (v24.3.1 - v26.2.3)"], "affected": "<= 26.2.3 without BT26-05-RS patch", "ecosystem": "vendor"}, {"name": "beyondtrust remote support", "fixed": [], "affected": "<= 26.2.3", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["beyondtrust", "exploited", "internet-facing", "poc-public", "remote-support", "self-hosted", "vendor"] not_affected_if: ["managed-hosting"] published_at: "2026-10-15T21:17:00+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:33:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102764", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "github-poc", "url": "https://github.com/CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check", "first_seen_at": "2026-10-23T23:55:02+00:00"}] --- # beyondtrust remote support: The vulnerability exists within internal components of BeyondTrust’s Remote Support product Improper origin validation (CWE-290) in an internal messaging component of BeyondTrust Remote Support lets an unauthenticated remote attacker perform file operations, including arbitrary file upload, on the appliance. CVSSv4 9.3. Exploited in the wild since 2026-08-29 (Mandiant: SAWFLY web shell, BARECLAW tunneler, root escalation). In CISA KEV since 2026-10-16. SaaS was patched 2026-10-09; self-hosted appliances need the patch applied. Self-hosted Privileged Remote Access shares the code; BeyondTrust has found no exploit path there but recommends patching. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:BeyondTrust Remote Support affected ? fixed ? - vendor:BeyondTrust Remote Support affected <= 26.2.3 without BT26-05-RS patch fixed BT26-05-RS patch (v24.3.1 - v26.2.3) - vendor:beyondtrust remote support affected <= 26.2.3 fixed ? ## How to check Self-hosted: open the /appliance interface and confirm the BT26-05-RS patch is installed, and check the RS version (all versions <= 26.2.3 are affected without the patch). Hunt for unrecognized admin sessions from residential or VPN IPs, unexpected scripts in web directories, changes to Jump Items or Teams, log-forwarding gaps, mangoapi.php, ingredi_ws, /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, and a /uidchanarge route in /ns/config/haproxy.conf. Rapid7 and Nexpose have an authenticated check. ## Fix Apply the BT26-05-RS patch (for RS 24.3.1 to 26.2.3) in the /appliance interface. Instances older than 24.3.1 must upgrade first, then patch. Patching does not remove persistence: preserve evidence, isolate, rebuild from a clean patched image if compromise cannot be ruled out, and rotate stored credentials. Forward appliance logs to an external SIEM. ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764 - 2026-10-23T21:33:50+00:00 analyst — Read BeyondTrust BT26-05 (primary) and Rapid7 analysis. Exploited since Aug 29 2026 (ARMORY CASTLE per Mandiant). No public PoC found; social chatter not searched. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102764 - 2026-10-23T23:55:02+00:00 github-poc https://github.com/CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check ## Documents - [advisory] BeyondTrust BT26-05 https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 - [describes] Rapid7: CVE-2026-102764 exploited in the wild https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild - [poc] CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check https://github.com/CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check ## From the sources BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_