[Urgent] BeyondTrust Remote Support CVE-2026-102764: Apply the BT26-05-RS Patch (CVSS v4.0 9.3) — Exploited Since Late August; Check Self-Hosted Appliances for Compromise

BeyondTrust Remote Support, a remote-support product, has a flaw that lets an attacker perform file operations on the appliance without authenticating. It is CVE-2026-102764. It was recorded in the NVD on 15 October 2026, and CISA added it to KEV (its catalog of known exploited vulnerabilities) on 16 October. The Canadian Centre for Cyber Security also says it is being exploited.

If you run the appliance yourself (self-hosted), apply the patch BT26-05-RS. And do not stop at patching: check whether the appliance was already compromised. Mandiant reports exploitation began in late August, before a fix existed, so an appliance may have been attacked before you patched.

For Remote Support SaaS, the vendor had applied the patch to all tenants by 9 October (Mandiant / GTIG, Canadian Centre for Cyber Security). No customer action is required for the appliance itself, but Mandiant writes that "the credential and configuration steps" (the response steps in this article) "still apply." Check the vendor's guidance for what SaaS customers should do.

Where the score comes from. The 9.3 is CVSS v4.0, assigned by the CNA, BeyondTrust, with the vector `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` (over the network, no privileges, no user interaction). The NVD (NIST) assigns 9.8 CRITICAL under CVSS v3.1. The numbers differ because the versions differ. This article uses the vendor's value (v4.0 9.3) in the box and lists NIST's alongside. The weakness is CWE-290 (authentication bypass by spoofing), which CISA's KEV calls "Authentication Bypass by Spoofing."

What to do now

• ✓Find out whether you use the SaaS or the self-hosted version. The vendor had patched SaaS by 9 October and nothing is required for the appliance itself (but, as above, the credential and configuration steps may still apply; Mandiant says SaaS tenants can ask BeyondTrust Support for forensic preservation). If you run the appliance yourself (self-hosted), you must act yourself
• ✓For self-hosted, apply the patch BT26-05-RS. It covers versions 24.3.1 to 26.2.3. If you are on a version older than 24.3.1, upgrade to a supported version first, then apply the patch (Canadian Centre for Cyber Security)
• ✓Check whether automatic updates are enabled. If not, the patch must be applied manually. Follow the vendor's procedure in the appliance interface and in advisory BT26-05
• ✓Treat any appliance that was reachable from the internet while vulnerable as possibly compromised, and investigate. The Canadian Centre asks you to look for unexpected or unauthorized file activity on the appliance. Mandiant also writes that patching does not remediate earlier compromise
• ✓Preserve evidence before you change things. Because the attacker deletes logs on the appliance, Mandiant recommends snapshotting virtual appliances (with memory), exporting disks, and collecting syslog, reverse-proxy/WAF and firewall logs for the whole exposure window
• ✓If you suspect compromise, rebuild from a clean image. Mandiant recommends redeploying from a clean, fully patched image, issuing a new TLS certificate, and restoring only a configuration backup dated before the exposure window. Rotate credentials after patching or rebuilding, not before (rotating first can hand new credentials to an attacker who still controls the appliance). Rotate administrators, API secrets, SAML signing keys and integration credentials in dependency order
• ✓Check what the appliance can reach. Remote-support appliances store or broker credentials for other systems. Look for suspicious administrator sessions and for users or Jump Items whose permissions were raised. If you are unsure which appliances are yours, make an inventory first (the Canadian Centre also advises separating SaaS from self-hosted)

What the flaw does

• ▸Where and what: according to the NVD description, internal components of Remote Support did not adequately validate the origin of the messages they received. Under the right conditions, an attacker can perform file operations on the appliance
• ▸Authentication: the CVSS vector is `PR:N` (no privileges) and `UI:N` (no user interaction). CISA writes that a remote attacker can perform file operations on the appliance
• ▸Exploitation: CISA added it to KEV. CISA's SSVC assessment recorded in the NVD says exploitation is "active," automatable is "yes," and technical impact is "total"
• ▸Use in ransomware campaigns: the KEV field says "Unknown"

What Mandiant / GTIG report about the attacks

This section is based on the investigation report Google Cloud (Mandiant / Google Threat Intelligence Group) published. This site could not retrieve BeyondTrust's own page (access was blocked), so it did not read the vendor's original text. The vendor's blog points to the same report.

• ▸Start of exploitation: Mandiant observed zero-day exploitation in late August 2026. The report gives no more precise date. A zero-day means attacks began before a fix existed
• ▸Attacker: reported as ARMORY CASTLE, a "suspected PRC-nexus espionage threat actor" (formerly UNC5221). The wording is "suspected," not a firm attribution
• ▸After the break-in (per the report): a web shell (SAWFLY) is planted, privileges are raised to root, stored credentials are dumped, persistence is added that survives a reboot or configuration reset, logs are deleted, then the attacker logs in to the admin portal with administrator credentials, starts remote-support sessions to other machines, takes files, and runs a tunneling tool (BARECLAW)
• ▸Published indicators of compromise (IoCs): the web shell file `mangoapi.php` (SHA-256 `dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb`), the tunneler `ingredi_ws` (SHA-256 `1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462`), a SUID copy at `/usr/bin/dbus-authd`, and `zz-root-persist` under `post_boot.d`. More IoCs and YARA rules are in the report itself. Finding none does not prove you were not compromised, because the attacker deletes traces
• ▸Privileged Remote Access (PRA): BleepingComputer reports that the vendor released a patch for PRA too, because it shares the affected code. But the NVD lists only Remote Support as affected. If you self-host PRA, check the vendor's advisory for how your product is handled

Timeline

• ▸Late August onward: Mandiant observes zero-day attacks (Mandiant / GTIG)
• ▸8 October: BleepingComputer reports the vendor patched SaaS
• ▸9 October: the vendor says the fix is applied to all SaaS tenants (Mandiant / GTIG, Canadian Centre for Cyber Security)
• ▸15 October: BeyondTrust discloses the flaw; CVE-2026-102764 is recorded in the NVD
• ▸16 October: CISA adds it to KEV. The US federal due date recorded in the NVD is 19 October (today). It binds US federal agencies, not organizations in Japan, but it shows how urgent CISA considers it. The same day the Canadian Centre publishes alert AL26-025. The Mandiant / GTIG report was published around 15–16 October

What we could not confirm

• ▸The text of the vendor's advisory (BT26-05). Automated access returned 403, so the patch name and affected range were checked against the NVD, the Canadian Centre for Cyber Security and Mandiant / GTIG
• ▸The full set of IoCs. This article lists only part of the report. Additional IoCs are in a GTI Collection on VirusTotal, for registered users. Traces vary between victims, so not finding the listed indicators is not proof of safety
• ▸The attacker's attribution. It is Mandiant's "suspected" assessment; this site did not cross-check it against other vendors' tracking
• ▸The scope for PRA. As above, the NVD lists only Remote Support

Three lines to share

• ▸BeyondTrust Remote Support (26.2.3 and earlier) has a flaw that lets an attacker perform file operations on the appliance without authenticating (CVE-2026-102764, CVSS v4.0 9.3). It is reported as exploited since late August, and CISA added it to KEV on 16 October
• ▸★If you self-host, apply the patch BT26-05-RS (upgrade first if you are older than 24.3.1). The vendor had patched SaaS by 9 October (the credential and configuration steps may still apply)
• ▸Patching does not undo an earlier compromise. For appliances that were reachable from the internet, preserve snapshots and logs first, investigate, and rebuild if compromise is suspected. Rotate credentials after patching or rebuilding