What happened
On October 15, 2026, BeyondTrust disclosed a critical vulnerability in its Remote Support platform, tracked as CVE-2026-102764. The flaw allows unauthenticated remote attackers to bypass authentication and perform file operations on affected appliances without requiring user interaction. Versions 26.2.3 and earlier are impacted unless the specific patch BT26-05-RS has been applied. BeyondTrust confirmed that exploitation was occurring in the wild prior to the public disclosure, with known compromises dating back to August 29, 2026. These incidents involved both a BeyondTrust-hosted instance and a self-hosted appliance. The company identified and contained the hosted breach by September 28, and additional findings from investigations into the self-hosted environment were shared on September 30. The vulnerability has been added to the U.S. Cybersecurity and Infrastructure Security Agency's list of known exploited vulnerabilities as of October 16, 2026, and is actively being exploited. This flaw arises in BeyondTrust Remote Support, impacting the ability to securely control remote troubleshooting and endpoint management. The exploitation involves leveraging the authentication bypass to perform unauthorised file operations, which can lead to further compromise or malicious activities on affected networks. No patches were available at the time of disclosure, indicating a zero-day status, and emphasising the urgency for affected organisations to assess and respond rapidly. Who is affected Organisations running BeyondTrust Remote Support implementations that are on version 26.2.3 or earlier are affected unless the BT26-05-RS patch has been applied. This includes both hosted and self-managed assets, especially those exposed to the internet or accessible via vulnerable network configurations. As exploitation has been confirmed in active environments, all affected deployments are at immediate risk. The vulnerability's severity underscores the critical need for rapid assessment of remote support infrastructures within affected organisations. Recommended actions
Identify all instances of BeyondTrust Remote Support running version 26.2.3 or earlier. Immediately review configurations for exposed network interfaces that could facilitate unauthenticated access. Implement the BT26-05-RS patch or related updates as soon as they become available from the vendor. Investigate affected appliances for signs of prior compromise, focusing on unauthorised file operations or unusual activity. Monitor network traffic and security logs for indicators consistent with exploitation attempts.
