CVE-2026-102764
BeyondTrust Remote Support origin-validation flaw lets attackers write files
Unauthenticated attackers can perform file operations on self-hosted BeyondTrust Remote Support up to 26.2.3. Apply the BT26-05-RS patch. Exploited as a zero-day; in CISA KEV since 16 October 2026.
By ThreatWire Desk · Published 15 Oct 2026 · Updated 27 Oct 2026
- CVSS
- 9.3
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Class
- Auth bypass
- Status
- Active Exploitation
- KEV
- Listed in CISA KEV
- 0-day
- Yes
- Vendor
- BeyondTrust
- Products
- BeyondTrust Remote Support (RS), BeyondTrust Privileged Remote Access (PRA), patched as a precaution
- Affected
- Remote Support, all versions up to and including 26.2.3 without the BT26-05-RS patch. Self-hosted appliances only; SaaS instances were patched by BeyondTrust by 9 October 2026. BeyondTrust says Privileged Remote Access shares the affected code but found no way to exploit it there.
- Fixed
- BT26-05-RS patch for Remote Support 24.3.1 through 26.2.3, applied from the /appliance interface or by automatic updates. Versions older than 24.3.1 must upgrade to a supported release first. A matching patch exists for self-hosted Privileged Remote Access.
- CWE
- CWE-290
- Published
- 15 Oct 2026
- Updated
- 27 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-102764 lets an unauthenticated remote attacker perform file operations on a BeyondTrust Remote Support appliance. Internal messaging components did not check where the messages they received came from.
Affected: Remote Support up to and including 26.2.3. Fixed by: the BT26-05-RS patch for 24.3.1 through 26.2.3. Older versions must upgrade first.
BeyondTrust scores it CVSS 4.0 9.3 (Critical). NVD adds a CVSS 3.1 score of 9.8 (Critical). The weakness is CWE-290, authentication bypass by spoofing.
BeyondTrust patched its SaaS instances by 9 October 2026. Self-hosted appliances need the patch, unless automatic updates already applied it. BeyondTrust also shipped the patch for Privileged Remote Access as a precaution.
The flaw was used as a zero-day. BeyondTrust says the first known exploitation was on 29 August 2026, against two customers. It published the advisory on 15 October 2026.
CISA added the CVE to its KEV catalog on 16 October 2026, with a 19 October due date (checked 27 October 2026). Ransomware use is listed as unknown. Mandiant attributes the intrusions to the suspected China-nexus espionage group ARMORY CASTLE, formerly UNC5221.
No working public exploit code has been confirmed. The two GitHub repositories that claim a PoC contain only a README.
Read the full explainer: BeyondTrust Remote Support zero-day.
Sources
- Vendor advisory
- BeyondTrust blog, ARMORY CASTLE and BT26-05 (updated 16 October 2026)
- NVD CVE-2026-102764
- CVE.org record CVE-2026-102764
- CISA KEV catalog
- Mandiant / Google Threat Intelligence, ARMORY CASTLE Exploits BeyondTrust (15 October 2026)
- Canadian Centre for Cyber Security alert AL26-025 (16 October 2026)
Related on ThreatWire
- Threat reportAttackers exploited a BeyondTrust Remote Support zero-day: apply BT26-05
- CVE recordCVE-2026-114625: Arista VeloCloud Orchestrator SQL injection to superuser operator
- CVE recordCVE-2026-88779: NetScaler SAML memory overflow leading to denial of service
- CVE recordCVE-2026-88771: NetScaler unauthenticated command execution
- CVE recordCVE-2026-71362: Adobe Commerce and Magento Open Source incorrect authorization, customer account takeover