CVE-2026-102764 is a critical (CVSS 9.3) improper origin validation vulnerability in an internal messaging component of BeyondTrust Remote Support and Privileged Remote Access that allows a remote attacker to perform file operations on the appliance without authentication or user interaction. According to NVD, “The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.”
As of October 16, 2026, neither NVD nor BeyondTrust’s advisory BT26-05 specifies those conditions, and BeyondTrust is withholding technical details while self-hosted appliances are patched. BeyondTrust reports that a suspected China-nexus espionage actor exploited it as a zero-day on August 29, 2026, and Google’s Mandiant reports zero-day exploitation in late August 2026 by an actor it tracks as ARMORY CASTLE (formerly UNC5221). Censys currently detects 9,569 hosts and 177,497 web properties running BeyondTrust Remote Support or Privileged Remote Access, after excluding honeypots.
Details
| CVE ID | CVE-2026-102764. CVSS v4.0 9.3 (Critical) |
| Date of Disclosure | October 15, 2026 |
| Affected Assets | Self-hosted BeyondTrust Remote Support appliances. BeyondTrust patched its hosted (SaaS) service on October 9, 2026. BeyondTrust also released the patch for Privileged Remote Access, which shares the affected code. |
| Vulnerable Software Versions | Remote Support 26.2.3 and earlier |
| PoC Available | No public proof-of-concept has been identified as of October 16, 2026. |
| Exploitation Status | Exploited in the wild as a zero-day beginning August 29, 2026. Not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of October 16, 2026. |
| Patch Status | BeyondTrust released the BT26-05-RS patch for versions 24.3.1 through 26.2.3. |
Affected Assets
BeyondTrust’s advisory lists the affected versions as “All versions <= 26.2.3” of Remote Support and lists no affected version above 26.2.3 as of October 16, 2026. BeyondTrust applied the patch to all Remote Support SaaS customers, so the patching steps only apply to self-hosted appliances. Despite being patched, BeyondTrust-hosted instances still warrant review, since BeyondTrust reports the August 29 exploitation affected one of them.
The advisory covers Remote Support only. BeyondTrust’s blog post states that, as of October 15, 2026, its internal testing has not identified any way to exploit this vulnerability in Privileged Remote Access, but because it shares the affected code, BeyondTrust released the patch for both products and recommends self-hosted Privileged Remote Access customers also apply it.
The fix is a patch rather than a new release, so version alone does not reflect patch state. Censys does not extract a Remote Support version from scan data, so the counts below are total hosts and web properties running either product, not unpatched or vulnerable counts.
Censys Query
We currently detect 9,569 hosts and 177,497 web properties running an instance of BeyondTrust Remote Support or Privileged Remote Access using the following query. Before adding the honeypot exclusion, the queries matched 15,228 hosts and 197,901 web properties, so the label removed about 37% of host matches and about 10% of web property matches.
(
host.services.software: (vendor="beyondtrust"
and product={"remote_support", "privileged_remote_access"})
or web.software: (vendor="beyondtrust"
and product={"remote_support", "privileged_remote_access"})
)
and not labels:"HONEYPOT"Matches indicate product exposure, not a vulnerable version, so check each result against your patch records.
PoC Available?
No public proof-of-concept code has been identified as of October 16, 2026. BeyondTrust states it is withholding technical details of the vulnerability while self-hosted appliances are still being patched, and neither the NVD entry nor the advisory describes the conditions required for exploitation.
Exploitation Status
BeyondTrust reports that a suspected China-nexus espionage actor exploited this vulnerability as a zero-day on August 29, 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Google’s Mandiant also reports zero-day exploitation in late August 2026 by an actor it tracks as ARMORY CASTLE (formerly UNC5221). Mandiant advises organizations to prepare for widespread exploitation now that the vulnerability is public, and BeyondTrust expects the same.
As of October 15, 2026, CVE-2026-102764 has not been added to the CISA KEV catalog. Exploitation has been confirmed regardless, so do not use KEV status to set patch priority.
Patch Status
BeyondTrust fixed the issue with the BT26-05-RS patch, which covers Remote Support versions 24.3.1 through 26.2.3, documented in advisory BT26-05. BeyondTrust applied the patch to SaaS instances on October 9, 2026.
- Apply the BT26-05-RS patch to self-hosted appliances. Instances not subscribed to automatic updates must be patched manually from the
/applianceinterface, as described in the advisory. Appliances on a version older than 24.3.1 must be upgraded before the patch can be applied. Mandiant recommends confirming the patch in the/applianceinterface and opening a case with BeyondTrust Support citing BT26-05 if it is not visible there. - Reduce exposure while patching is pending. BeyondTrust advises exposing only the parts of the appliance that users and customers need, restricting administrative interfaces to trusted networks, and allowing outbound traffic from the appliance only to required destinations. Mandiant additionally recommends restricting access to the
/loginand/appliancepaths. These steps limit reach but do not fix the vulnerability. - Investigate internet-reachable instances for indicators of exploitation. BeyondTrust reports that indicators rarely repeat between victims and instead recommends looking for:
- unexpected privileged sessions from residential broadband or commercial VPN addresses
- unrecognized script files in web directories and web service accounts spawning shells
- unauthorized account, permission, or session-policy changes
- gaps in log forwarding that begin and end within a single session
- Treat unpatched exposure as potential compromise. Mandiant advises treating any internet-reachable appliance that ran a vulnerable version during the exploitation window as potentially compromised until reviewed, and notes that upgrading does not remediate prior exposure.
BeyondTrust asks customers who believe they have evidence of exploitation to open a support request.