BeyondTrust Remote Support Vulnerability: CVE-2026-102764 and How to Patch It

Introduction

Short answer:** CVE-2026-102764 is a critical BeyondTrust Remote Support vulnerability involving improper origin validation in an internal messaging component. Under the right conditions, a remote unauthenticated attacker may perform file operations on an affected appliance. BeyondTrust rates it **CVSS v4 9.3 Critical**, CISA has added it to the Known Exploited Vulnerabilities catalog, and CISA reports active exploitation. Organizations using self-hosted Remote Support should identify every appliance, verify its version, apply the BT26-05-RS patch where supported, and investigate possible compromise rather than treating patch installation as proof that the appliance is clean. [1] [2]

**Key Takeaways**

- BeyondTrust identifies Remote Support versions **26.2.3 and earlier** as affected.

- The vendor’s technical description is **improper origin validation in an internal messaging component**. It is more precise than calling the issue a conventional login bypass.

- The **BT26-05-RS** patch applies to supported versions **24.3.1 through 26.2.3**. Older deployments must upgrade before applying the remediation.

- BeyondTrust says its Remote Support and Privileged Remote Access SaaS customers were patched as of October 9, 2026. Self-hosted customers must verify their own status.

- CISA recommends patching, restricting unnecessary exposure, collecting forensic evidence, investigating activity and rotating credentials if compromise is suspected.

What is the BeyondTrust Remote Support vulnerability?

CVE-2026-102764 affects internal components of BeyondTrust Remote Support, the product formerly known as Bomgar. BeyondTrust says the affected component did not adequately validate the origin of messages it received. In the right conditions, that weakness could allow a remote attacker to perform file operations on the appliance. [1]

The issue is tracked as **CWE-290, Authentication Bypass by Spoofing**, in the NVD and government advisories. That classification describes the security weakness, but it should not replace the vendor’s more specific explanation. The published technical description is an origin-validation failure in an internal messaging component. It can create an unauthorized file-operation path without requiring a legitimate user to approve the action. [2] [3]

The vulnerability matters because a remote-support appliance sits at a sensitive trust boundary. It may connect support staff to endpoints, store or broker privileged credentials, process administrative sessions, and communicate with identity or network systems. A flaw in that appliance can therefore have consequences beyond the appliance itself.

### What does “authentication bypass by spoofing” mean here?

Authentication normally helps a system decide whether a request comes from an allowed identity or trusted component. Origin validation is related but distinct: it checks where a message or request came from and whether that source is permitted to perform the requested operation.

If internal components accept messages without adequately validating their origin, an attacker may be able to make an untrusted message appear to belong to a trusted path. The attacker does not necessarily need to steal a username and password first. In this case, the public advisories describe the result at a high level and do not provide a complete public exploit recipe. That is appropriate while organizations are still patching. [1]

How does CVE-2026-102764 work?

Public technical information supports a conceptual explanation, not a safe step-by-step reproduction. The vulnerable internal messaging path can accept a message whose origin is not properly validated. Under the right conditions, the resulting trust failure can be used to perform file operations on the appliance.

The important defensive questions are practical:

Mandiant’s analysis of the reported ARMORY CASTLE activity describes successful exploitation followed by file upload, a web shell, privilege escalation, credential-harvesting attempts and anti-forensic activity. Those findings come from an observed intrusion, not a claim that every vulnerable appliance was compromised. [5]

The distinction is important. **Vulnerable** means the product version is exposed to the flaw. **Exploited** means an attacker used the flaw. **Compromised** means the investigation has evidence that the attacker obtained or maintained unauthorized control. These terms should not be used interchangeably.

• Was the appliance running an affected version?
• Was it reachable from an untrusted network during the exposure window?
• Were unexpected files created, uploaded, changed or removed?
• Did administrative activity, support sessions, account changes or credential use look unusual?
• Were appliance logs forwarded to a system outside the appliance, where an attacker could not easily erase them?

Which BeyondTrust versions are affected?

BeyondTrust’s BT26-05 advisory lists **all Remote Support versions up to and including 26.2.3** as affected. The fixed release is the **BT26-05-RS patch for versions 24.3.1 through 26.2.3**. Deployments older than 24.3.1 must first upgrade to a newer supported version before the remediation patch can be applied. [1]

The NVD record also identifies Remote Support versions through 26.2.3 as affected and records the vendor-provided CVSS v4 score of 9.3 Critical. NVD’s own assessment is not a separate NIST score; the displayed CVSS information is contributed by the CVE Numbering Authority, BeyondTrust. [3]

### Self-hosted and SaaS deployments

The response depends on how Remote Support is hosted:

A SaaS statement does not eliminate the need to check connected identity systems, support sessions or credentials when an organization has separate self-hosted appliances, integrations or other exposed remote-access products.

• **Self-hosted Remote Support:** identify the appliance, verify the exact version and patch status, and apply BT26-05-RS according to the vendor’s instructions. If automatic updates are not enabled or the instance is not subscribed to them, manual action may be required.
• **BeyondTrust-hosted Remote Support SaaS:** BeyondTrust says the patch was applied to all Remote Support SaaS customers as of October 9, 2026.
• **Privileged Remote Access:** BeyondTrust says it did not identify a way to exploit the vulnerability in PRA during internal testing, but the product shares affected code. The vendor released a patch for self-hosted PRA customers as a precaution and recommends applying it. [4]

Is CVE-2026-102764 being actively exploited?

Yes, the active-exploitation claim is supported by government and vendor reporting. CISA’s October 16 alert says cyber threat actors are actively exploiting CVE-2026-102764 for initial access, persistence, privilege escalation and lateral movement. CISA also added the CVE to its Known Exploited Vulnerabilities catalog on October 16, with a catalog due date of October 19, 2026. [2] [3]

BeyondTrust and Google Threat Intelligence describe a specific zero-day intrusion involving the actor they call ARMORY CASTLE, which Mandiant formerly tracked as UNC5221. BeyondTrust says its published timeline includes one BeyondTrust-hosted Remote Support instance and one self-hosted Remote Support appliance exploited on August 29, 2026. In the vendor’s October 16 update, BeyondTrust said it was aware of the two impacted customers described in its post and had not seen evidence of adversary activity since August. [4] [5]

These reports establish that exploitation occurred. They do **not** establish that every affected appliance was attacked, that every unusual event is related to this CVE, or that a patched appliance was never compromised.

How to protect a BeyondTrust Remote Support appliance

### 1. Find every deployment

Start with an asset inventory. Include production, disaster-recovery, test and temporarily disconnected appliances. Record whether each deployment is self-hosted or SaaS-hosted, the appliance owner, the installed product branch, the exposure path, the update channel and the systems connected to it.

Do not rely only on a product inventory export. Remote-support appliances can be owned by infrastructure, service-desk, managed-service or regional teams. Search change records, DNS, firewall rules, reverse proxies and support documentation for additional instances.

### 2. Verify the exact installed version

Treat Remote Support **26.2.3 and earlier** as affected according to the vendor advisory. Record the exact version and build rather than a broad label such as “current” or “26.x.” If the deployment is older than 24.3.1, plan the prerequisite upgrade to a supported version before applying BT26-05-RS.

Capture the evidence of the version check and patch completion. A screenshot may help an operator, but the change record should also include the appliance identity, timestamp, old version, new version, patch result and the person or system that performed the change.

### 3. Apply BT26-05-RS

Apply the vendor’s official patch procedure to affected self-hosted versions. Schedule the work with an alternate access path and an owner who can confirm that critical support workflows are available after the update.

If the patch cannot be applied immediately, reduce exposure while the upgrade is prepared. CISA recommends limiting external access to only the services needed for support and restricting administrative interfaces to trusted networks. A temporary access restriction reduces opportunity; it does not replace the patch. [2]

### 4. Preserve evidence before destructive cleanup

If suspicious activity exists, do not wipe the appliance, delete files or reset credentials before an incident-response decision is made. Isolate a suspected appliance as appropriate, collect a virtual snapshot or forensic image, and forward appliance syslog and session events to an external SIEM. Also preserve reverse-proxy, web-application-firewall, perimeter-firewall, identity and network-flow logs for the relevant exposure window. [2]

The exact collection process should be handled by qualified responders. A general administrator should not improvise forensic changes on a live appliance if doing so could destroy evidence or interrupt a critical support service without a recovery plan.

What should security teams check after patching?

Patching closes the known vulnerability path. It does not answer whether the path was used before patching. CISA recommends network and memory forensics for affected self-hosted appliances, and its alert identifies several activity classes worth reviewing. [2]

Look for:

Mandiant reported that ARMORY CASTLE used custom malware, the SAWFLY web shell and the BARECLAW tunneler in the investigated intrusion, and that the actor deleted logs and endpoint artifacts. Organizations should use the vendor and government guidance for current indicators and detection content rather than copying unverified strings into production rules. [5]

If compromise is suspected, CISA recommends rebuilding from a known-good state after evidence collection, applying the patch, rotating every credential the appliance stored or injected, revoking active support sessions, and reviewing new multifactor-authentication registrations on privileged accounts. [2]

• Unrecognized privileged or administrative sessions.
• Unexpected script files or file uploads.
• Unexpected gaps in appliance logs or external log forwarding.
• Unauthorized account, permission or session-policy changes.
• Unusual support-session activity or access to sensitive endpoints.
• New or changed credentials, certificates, API keys or integration settings.
• Network connections that do not match the organization’s support workflows.
• Evidence of lateral movement from the appliance into identity, endpoint or server environments.

Could this vulnerability affect organizations in India?

Yes, Indian organizations can be exposed if they operate an affected self-hosted BeyondTrust Remote Support appliance or connect to one through a service provider. Potentially relevant environments include enterprises with distributed support teams, IT and business-process outsourcers, government organizations, hospitals, financial services companies and managed-service providers.

That is a statement about potential exposure, not evidence of a confirmed India-specific incident. The public advisories reviewed for this article do not establish that an Indian organization was compromised by CVE-2026-102764. Indian security teams should follow their incident-response procedures and assess any applicable CERT-In, contractual, regulatory or legal reporting obligations with qualified advisers.

For broader defensive context, readers can review CYBERoinfo’s [India cybersecurity guide](/articles/india-cybersecurity), [data breach response guide](/articles/data-breach-response), [zero-day vulnerabilities explainer](/articles/zero-day-vulnerabilities), and [security operations guide](/articles/security-operations-soc-siem-xdr-soar).

Frequently asked questions

### What is CVE-2026-102764?

It is a critical BeyondTrust Remote Support vulnerability involving improper origin validation in an internal messaging component. Under the right conditions, a remote unauthenticated attacker may perform file operations on an affected appliance. The vendor assigns CVSS v4 9.3 Critical, and the issue is classified as CWE-290 Authentication Bypass by Spoofing. [1] [3]

### Is BeyondTrust Remote Support vulnerable?

Remote Support versions 26.2.3 and earlier are listed as affected by BeyondTrust. Check the exact installed version and patch status. Do not assume that a product labelled “Remote Support” is safe or vulnerable without verifying the version and hosting model.

### How do I patch CVE-2026-102764?

Apply the BT26-05-RS patch to supported Remote Support versions 24.3.1 through 26.2.3 according to BeyondTrust’s advisory. Deployments older than 24.3.1 must upgrade first. Self-hosted customers should verify whether automatic updates are enabled and confirm the result in their change records.

### Are BeyondTrust SaaS customers affected?

BeyondTrust says all Remote Support SaaS customers were patched as of October 9, 2026. BeyondTrust also says the patch was applied to Privileged Remote Access SaaS customers. Organizations should still identify any separate self-hosted instances and review connected accounts and integrations if suspicious activity is found. [1] [4]

### What should administrators do if they suspect exploitation?

Preserve evidence, isolate the suspected appliance where appropriate, collect external and appliance logs, and involve qualified incident responders. Follow CISA’s guidance for forensic investigation, rebuilding from a known-good state, applying the patch and rotating credentials, certificates, keys and active support sessions. Do not treat a clean single log or a successful patch as proof that no compromise occurred. [2]

Final perspective

CVE-2026-102764 is a serious remote-support appliance vulnerability because the product sits between support personnel, endpoints, credentials and internal systems. The public evidence supports an urgent response, but responsible reporting still requires precision: the flaw is an origin-validation weakness that can enable unauthorized file operations; active exploitation has been reported; and a vulnerable version is not the same thing as confirmed compromise.

The practical sequence is clear. Inventory every deployment, verify the exact version, apply BT26-05-RS or upgrade first when necessary, restrict unnecessary exposure, preserve evidence, investigate suspicious activity and rotate connected secrets when compromise is possible. Patch quickly, but investigate carefully.

Private SEO keyword set

BeyondTrust Remote Support authentication bypass; CVE-2026-102764 BeyondTrust; BeyondTrust Remote Support vulnerability; BeyondTrust security advisory October 2026; BeyondTrust Remote Support patch; authentication bypass vulnerability; BeyondTrust self-hosted versions affected; BeyondTrust CVE-2026-102764 patch; BT26-05-RS patch; BeyondTrust Remote Support affected versions; BeyondTrust zero-day; BeyondTrust vulnerability actively exploited; BeyondTrust SaaS patch; Remote Support appliance security; BeyondTrust file operations vulnerability; how to check BeyondTrust vulnerability

References

[1]: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 "BeyondTrust BT26-05 Security Advisory"

[2]: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support "CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support"

[3]: https://nvd.nist.gov/vuln/detail/CVE-2026-102764 "NVD CVE-2026-102764 Detail"

[4]: https://www.beyondtrust.com/blog/entry/bt26-05 "ARMORY CASTLE and BT26-05: What Security Teams Need to Know"

[5]: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust "Google Threat Intelligence: ARMORY CASTLE Exploits BeyondTrust"

[6]: https://www.cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764 "Canadian Centre for Cyber Security AL26-025"

Decision checklist

• Was the appliance running an affected version?
• Was it reachable from an untrusted network during the exposure window?
• Were unexpected files created, uploaded, changed or removed?
• Did administrative activity, support sessions, account changes or credential use look unusual?
• Were appliance logs forwarded to a system outside the appliance, where an attacker could not easily erase them?
• **Self-hosted Remote Support:** identify the appliance, verify the exact version and patch status, and apply BT26-05-RS according to the vendor’s instructions. If automatic updates are not enabled or the instance is not subscribed to them, manual action may be required.
• **BeyondTrust-hosted Remote Support SaaS:** BeyondTrust says the patch was applied to all Remote Support SaaS customers as of October 9, 2026.
• **Privileged Remote Access:** BeyondTrust says it did not identify a way to exploit the vulnerability in PRA during internal testing, but the product shares affected code. The vendor released a patch for self-hosted PRA customers as a precaution and recommends applying it. [4]
• Unrecognized privileged or administrative sessions.
• Unexpected script files or file uploads.
• Unexpected gaps in appliance logs or external log forwarding.
• Unauthorized account, permission or session-policy changes.

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. beyondtrust.com — BeyondTrust BT26-05 Security Advisory
2. cisa.gov — CISA BeyondTrust Remote Support Alert
3. nvd.nist.gov — NVD CVE-2026-102764 Detail
4. cloud.google.com — Google Threat Intelligence BeyondTrust Analysis