CriticalCVECVE-2026-102764
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Rapid7·Source published ·1 min read
What happened?
Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3, the vulnerability allows unauthenticated remote attackers to perform file operations on an affected appliance without user interaction. Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied. BeyondTrust has confirmed that exploitation in the wild has already occurred prior to disclosure.
Key details
- Critical authentication bypass in BeyondTrust Remote Support allows unauthenticated remote attackers to perform file operations without user interaction.
- Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied.
- Exploitation in the wild occurred prior to disclosure, with compromises dated August 29, 2026.
- Mandiant attributes exploitation to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221.
- Exploitation deployed SAWFLY PHP web shell and BARECLAW tunneler, with root escalation and credential-vault extraction attempts.
- BeyondTrust recommends immediate patching of self-hosted Privileged Remote Access due to shared affected code.
Affected
- Remote Support versions 26.2.3 and earlier unless patched.
- Older deployments older than 24.3.1 require upgrade to a patch-supported version first.
Fixes and mitigations
- Apply the BT26-05-RS patch for versions 24.3.1 through 26.2.3.
- SaaS customers were patched by BeyondTrust as of October 9, 2026.
What to look for
- Unrecognized administrative sessions from residential broadband or commercial VPN addresses.
- Unexpected scripts in web directories or shells spawned by web service accounts.
- Unauthorized account, permission, or session-policy changes to Jump Items or Teams.
- Gaps in log forwarding bounded by a single session.
- Additional artifacts: /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, and unauthorized /uidchanarge route in /ns/config/haproxy.conf.
Summarised by SecOraLens from Rapid7. Always read the original source before acting. How SecOraLens verifies advisories.