BeyondTrust Remote Support CVE-2026-102764: A Source-Grounded Technical Brief
Vulnerability overview
CVE-2026-102764 is a critical BeyondTrust Remote Support vulnerability disclosed on October 15, 2026. BeyondTrust assigns CWE-290, improper origin validation, and CVSSv4 9.3. The affected internal messaging components did not adequately check where received messages came from. Under the right conditions, a remote attacker could use the failure to perform file operations.
The public record supports a clear risk assessment and a limited technical explanation. BeyondTrust withheld exploit details during the patch window, and Mandiant documented the intrusion and its aftermath. Statements about the exact failing function should be treated as speculation unless the vendor later publishes more detail.
Mechanism and exploitation conditions
The CVSS vector is network-reachable, requires no privileges and needs no user interaction. Mandiant describes the exploitation as unauthenticated and tied to arbitrary file upload. Once the actor could write to the appliance, it used the existing web service to launch a command channel.
The exploit did not depend on a victim opening a document or approving a prompt. The relevant precondition was access to a vulnerable Remote Support appliance exposed to the attacker's network. That makes patch and internet-exposure inventories more useful than user-focused phishing checks.
Impact
Mandiant observed a PHP web shell named SAWFLY, a SUID shell used for root-level access, changes to boot-time and sudoers templates, credential-vault queries and a SOCKS5 tunneler exposed through the reverse proxy. The actor deleted logs and modified application permissions.
The impact reaches the credentials and trust relationships managed by the appliance. Remote Support can store passwords, broker sessions and define which administrators can reach which endpoints. An attacker with host access can use that position to move into downstream systems.
Affected products and scope
Remote Support versions through 26.2.3 are affected. The BT26-05-RS patch covers versions 24.3.1 through 26.2.3, while older releases need an upgrade first. BeyondTrust also patched PRA as a precaution because the products share code but did not confirm an exploitation path in PRA.
The exploitation window matters. BeyondTrust's timeline places the zero-day use on August 29, 2026, and public disclosure on October 15. An appliance that was reachable on a vulnerable build during that period needs more than a patch check.
Exposure context
ZoomEye returned 962 matches for title="BeyondTrust" and 0 for vul.cve="CVE-2026-102764". The title query is broad. It can include public login pages, documentation and unrelated pages using the vendor name. It does not prove the installed product, version or vulnerability status.
Use the count to identify possibly relevant public properties, then confirm ownership and patch state through administrative records. Do not present the title count as a confirmed vulnerable population.
Remediation and mitigations
Apply or verify BT26-05-RS. SaaS instances were patched by BeyondTrust, but customer-side credentials and configuration still need review. Restrict administrative interfaces and outbound access, forward logs off the appliance and monitor for unusual support sessions.
When compromise is possible, preserve memory and disk evidence first. Isolate at the perimeter, collect firewall, proxy and identity logs, and rotate credentials in dependency order. Rebuild from a clean image if host-level persistence or credential access cannot be excluded.
Mandiant recommends treating any appliance reachable from the internet on a vulnerable version during the exploitation window as potentially compromised until reviewed. A patch closes the vulnerability. It does not restore confidence in a host that an attacker may already have controlled.
Top comments (0)