BeyondTrust Remote Support Auth Bypass Allows Unauthenticated File Operations

BeyondTrust disclosed a critical authentication bypass in its Remote Support platform on 15 October 2026. The flaw, tracked as CVE-2026-102764, permits unauthenticated attackers to perform file operations on affected appliances without user interaction.

What happened

The vendor confirmed wild exploitation prior to disclosure. Two known compromises occurred on 29 August 2026: one BeyondTrust-hosted instance and one self-hosted appliance. BeyondTrust contained the hosted breach on 28 September, while Mandiant corroborated findings from the self-hosted investigation on 30 September.

CISA added CVE-2026-102764 to its list of known exploited vulnerabilities on 16 October 2026. The agency set a 19 October 2026 due date for remediation and marked forensic triage as required. Rapid7 recommends emergency patching and investigation of all RS appliances for prior compromise.

The underlying issue involves inadequate validation of incoming message origins. This authentication bypass by spoofing (CWE-290) affects versions 26.2.3 and earlier. A vendor patch, BT26-05-RS, is available for versions 24.3.1 through 26.2.3. Older deployments require an upgrade to a supported version first.

Why it matters

Mandiant attributed the August activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor. The group deployed the SAWFLY PHP web shell and BARECLAW tunneler, escalated to root, and attempted credential-vault extraction. They also established persistence and deleted logs to cover their tracks.

BeyondTrust's remote access products have previously been targeted earlier this year. Rapid7 covered CVE-2026-1731, which was added to KEV in February 2026. This recurring targeting of BeyondTrust infrastructure highlights the persistent risk to remote administration tools. Patching does not remove existing persistence mechanisms or restore deleted logs.

Next steps

• Apply the BT26-05-RS patch to all self-hosted Remote Support appliances immediately.
• Upgrade instances older than version 24.3.1 to a patch-supported version before applying the fix.
• Verify SaaS deployments are patched, as BeyondTrust confirmed all SaaS customers were updated by 9 October.
• Patch Privileged Remote Access appliances, which share affected code, even though no PRA exploitation method is identified.

Detection notes

Security operations teams should monitor for unusual administrative sessions originating from residential broadband or commercial VPN addresses. Analysts typically review file integrity logs for unexpected modifications or new web shell deployments. Check whether root-level processes are running without corresponding user authentication events. Isolate suspected appliances immediately to prevent lateral movement. Preserve evidence before rebooting, as restarting may destroy volatile memory artefacts indicating tunneler activity or credential extraction attempts.

Background: Emergency patching

Emergency patching is the accelerated deployment of security fixes to address actively exploited or imminent threats. It suspends normal testing cycles to prioritise containment, requiring rigorous post-deployment verification to ensure system stability is maintained despite the speed.

Read the full guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

What to do and how to stay safe: BeyondTrust

• Inventory all Remote Support and Privileged Remote Access appliances to identify versions 26.2.3 and earlier.
• Apply the BT26-05-RS patch outside of normal maintenance windows to reduce exposure time.
• Rotate all stored or brokered credentials after patching or rebuilding compromised systems.
• Monitor network traffic for connections to known malicious infrastructure associated with ARMORY CASTLE.

Step-by-step guide: Mitigations vs Workarounds: Why Your Security Strategy Is Failing

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does patching remove existing backdoors?

No, BeyondTrust states that patching does not remove persistence mechanisms; compromised systems require rebuilding from a clean image.

Are SaaS customers affected?

BeyondTrust confirmed that all Remote Support SaaS customers were patched by 9 October 2026, but credential reviews are still recommended.

When must forensic triage be completed?

CISA lists an October 19, 2026 due date for remediation and marks forensic triage as required for affected environments.