BeyondTrust CVE-2026–102764: A Critical Remote Support Vulnerability Under Active Exploitation

Executive summary

Remote support platforms are designed to give IT teams access to systems when troubleshooting and maintenance are required. Because these platforms often have privileged access to organizational environments, a vulnerability in the platform itself can create significant security risk.

On October 15, 2026, BeyondTrust published security advisory BT26–05 for CVE-2026–102764, a critical authentication-bypass vulnerability in BeyondTrust Remote Support. The vendor assigned the issue a CVSS v4.0 score of 9.3.

The vulnerability involves inadequate validation of message origin within an internal messaging component. Under the right conditions, a remote attacker may perform unauthorized file operations on an affected appliance without authentication.

The Canadian Centre for Cyber Security and NHS England subsequently reported indications of exploitation in the wild.

For defenders, the immediate priorities are to identify affected deployments, apply the vendor's remediation, and investigate potentially suspicious activity on appliances that were exposed while vulnerable.

1. What is CVE-2026–102764?

CVE-2026–102764 is an authentication-bypass-by-spoofing vulnerability, classified under CWE-290, affecting BeyondTrust Remote Support.

According to BeyondTrust's advisory, internal components did not adequately validate the origin of messages they received. Under certain conditions, this weakness could permit an attacker to perform file operations on the appliance.

The important distinction is that the vulnerability concerns the trust placed in internal messages. If a component accepts a message without adequately establishing that it came from a legitimate source, an attacker may be able to perform actions that should be restricted.

Key details

• CVE: CVE-2026–102764
• Vendor advisory: BT26–05
• CVSS v4.0: 9.3
• Affected product: BeyondTrust Remote Support
• Affected versions: Versions 26.2.3 and earlier, according to the vendor
• Vulnerability type: Authentication bypass by spoofing
• Potential impact: Unauthorized file operations and possible appliance compromise

Sources: BeyondTrust security advisory BT26–05 · Canadian Centre for Cyber Security alert

2. Why is this vulnerability important?

Remote support software is often deployed to help technicians administer systems, troubleshoot endpoints and maintain business operations. Depending on the environment, these appliances may be connected to sensitive infrastructure or used as part of privileged IT workflows.

A weakness in such a platform can therefore have consequences beyond the application itself.

Remote access without normal authentication

The reported attack scenario does not require the attacker to authenticate to the vulnerable component. This reduces one important barrier to exploitation.

It does not mean that every deployment is automatically exploitable under every network configuration. Exposure and the relevant product conditions still matter.

Unauthorized file operations

The vendor describes the potential for unauthorized file operations on an affected appliance. Government guidance warns that arbitrary file uploads could contribute to a broader compromise.

Defenders should not automatically equate this vulnerability with confirmed operating-system-level code execution in every case. The specific impact depends on how the weakness is exploited and the environment involved.

A real-world exploitation signal

The Canadian Centre for Cyber Security reported open-source indications of exploitation in the wild in its October 16 alert. NHS England also reported observed exploitation involving custom malware and web shells.

This makes the issue more urgent than a vulnerability with no known exploitation evidence. Organizations should prioritize remediation while also considering whether previously exposed appliances need investigation.

Sources: Canadian Centre for Cyber Security, October 16, 2026 · NHS England Digital alert, October 16, 2026

3. Who should investigate?

Start with organizations operating BeyondTrust Remote Support, particularly self-hosted appliances that may not receive automatic updates.

BeyondTrust's advisory lists Remote Support versions 26.2.3 and earlier as affected. It also recommends that self-hosted Privileged Remote Access customers apply the relevant patch as a precaution, although the vendor says its internal testing did not identify an exploitation method for that product.

Organizations using SaaS offerings should verify their status with the vendor. BeyondTrust stated that the remediation had been applied to Remote Support SaaS customers by October 9, 2026, and that its SaaS Privileged Remote Access customers were also patched.

Do not assume a deployment is protected merely because it is cloud-hosted or because automatic updates are normally enabled. Confirm the actual remediation status.

4. Recommended mitigation steps

Step 1: Identify affected appliances

Inventory all BeyondTrust Remote Support deployments. Record whether each instance is SaaS-hosted or self-hosted, its version, its internet exposure and its patch status.

Include appliances managed by separate IT teams or third-party service providers.

Step 2: Apply the vendor's remediation

BeyondTrust provides the BT26–05-RS patch for affected Remote Support versions 24.3.1 through 26.2.3.

Self-hosted customers should follow the vendor's instructions and manually apply the patch if their appliance is not subscribed to automatic updates. Customers running versions older than 24.3.1 need to upgrade to a newer version before applying the remediation patch.

For Privileged Remote Access, follow the vendor's specific advisory and patch instructions.

Do not rely on disabling a feature or restricting access as a substitute for the required patch.

Step 3: Verify remediation

After patching, confirm the appliance's status in the management interface and retain evidence of the installed remediation. Recheck assets that were offline, missed maintenance windows or are managed by external providers.

Step 4: Investigate suspicious activity

Patching fixes the vulnerability; it does not prove that a previously exposed appliance was never compromised.

Review available logs and telemetry for:

• Unexpected or unauthorized file operations.
• Unrecognized files or web-shell-like artifacts.
• Unusual administrative activity.
• Unexpected outbound connections.
• Changes that cannot be explained by approved maintenance.

Use the vendor's advisory and trusted incident-response guidance to determine which artifacts and logs are relevant. Preserve evidence before performing actions that could destroy useful forensic information.

If compromise is suspected, isolate the affected system where operationally appropriate and follow your incident-response process.

Step 5: Improve vulnerability-management practices

This incident highlights several useful controls:

• Maintain an accurate inventory of internet-facing and remote-access infrastructure.
• Prioritize vulnerabilities with credible evidence of exploitation.
• Establish clear patching ownership for security appliances.
• Verify remediation rather than relying only on deployment notifications.
• Monitor sensitive appliances for suspicious changes and file activity.

5. What should security teams learn from this incident?

The central lesson is that remote support systems are security-sensitive infrastructure, not just ordinary business applications.

A critical vulnerability in a trusted management tool can expose an organization to risks that extend beyond the tool itself. Security teams need to combine rapid patching with asset visibility and post-exposure investigation.

Each stage matters. A patch that is available but never applied does not reduce risk. A patch that is applied without checking the appliance's earlier exposure may also leave important incident-response questions unanswered.

Conclusion

CVE-2026–102764 demonstrates why authentication bypasses in remote administration infrastructure deserve immediate attention, especially when exploitation has been reported.

Organizations running BeyondTrust Remote Support should verify their versions, apply the BT26–05 remediation where required, and investigate suspicious activity on appliances that were vulnerable.

The goal is not only to close the vulnerability, but also to establish whether the system remained trustworthy throughout the exposure period.

References

1. BeyondTrust — Security Advisory BT26–05. Issued October 15, 2026. https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
2. BeyondTrust — "ARMORY CASTLE and BT26–05: What Security Teams Need to Know." Updated October 16, 2026. https://www.beyondtrust.com/blog/entry/bt26-05
3. Canadian Centre for Cyber Security — Alert AL26–025, CVE-2026–102764. October 16, 2026. https://www.cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764
4. NHS England Digital — "Active Exploitation of BeyondTrust Remote Support Vulnerability (CVE-2026–102764)." October 16, 2026. https://digital.nhs.uk/cyber-alerts/2026/cc-4870
5. National Vulnerability Database — CVE-2026–102764. https://nvd.nist.gov/vuln/detail/CVE-2026-102764

This article is based on the cited public advisories available at the time of writing. Verify current vendor guidance and remediation status before taking action.