{"id":"beyondtrust-remote-support-auth-bypass-oct-2026","category":"patch","status":"live","title":"BeyondTrust Remote Support login bypass CVE-2026-102764 exploited since August; patch BT26-05-RS","tldr":"BeyondTrust Remote Support has a critical login-bypass flaw (CVE-2026-102764) attackers used from late August. Cloud customers are already patched. Self-hosted IT teams should apply BT26-05-RS now and check for earlier compromise.","summary":"BeyondTrust Remote Support, a tool IT teams use to remotely control computers, has a critical flaw that lets an attacker with no password perform file operations on the server and take it over. BeyondTrust says it was used in attacks before it was known: two systems, one hosted by BeyondTrust and one self-hosted, were compromised from 29 August 2026. Mandiant links the activity to ARMORY CASTLE, a suspected China-linked espionage group, which installed a web shell, escalated to root, wiped logs and sought stored credentials. BeyondTrust patched its cloud customers by 8 or 9 October (sources differ) and published advisory BT26-05 with the BT26-05-RS patch on 15 October. The patch covers self-hosted versions 24.3.1 to 26.2.3; older ones must be upgraded first. CISA listed the flaw as exploited on 16 October. Rapid7 reports that technical analysis and a public exploit module now exist. Patching does not remove an attacker already inside, so exposed appliances should be investigated.","action":"If your business runs a self-hosted BeyondTrust Remote Support or Privileged Remote Access appliance, apply the BT26-05-RS patch now (upgrade first if older than 24.3.1), and ask your IT provider to check for earlier compromise and rotate stored credentials. Cloud-hosted customers need do nothing. Families don't normally run this product.","product":"BeyondTrust Remote Support (and Privileged Remote Access) self-hosted appliances","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-102764"],"tags":["beyondtrust","remote-support","authentication-bypass","zero-day","cisa-kev","armory-castle","self-hosted"],"affected":["BeyondTrust Remote Support 26.2.3 and earlier (self-hosted)","BeyondTrust Privileged Remote Access (self-hosted; shares the affected code, no exploit path found by BeyondTrust)"],"fixed":["BT26-05-RS patch for Remote Support 24.3.1 to 26.2.3","SaaS tenants patched by BeyondTrust by 8 to 9 October 2026"],"matches":[],"sources":[{"kind":"advisory","title":"BeyondTrust security advisory BT26-05","url":"https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","by":"BeyondTrust","date":"2026-10-15"},{"kind":"advisory","title":"Alert AL26-025: Critical vulnerability impacting BeyondTrust Remote Support","url":"https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764","by":"Canadian Centre for Cyber Security","date":"2026-10-16"},{"kind":"research","title":"CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild","url":"https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild","by":"Rapid7","date":"2026-11-02"},{"kind":"news","title":"BeyondTrust patches zero-day exploited in attacks since August","url":"https://bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august","by":"BleepingComputer","date":"2026-10-15"}],"started":"2026-10-15","closed":null,"created":"2026-11-03T22:06:35.947Z","updated":"2026-11-03T22:06:35.947Z","cve_notes":[{"cve":"CVE-2026-102764","name":"Login bypass in BeyondTrust Remote Support","what":"An authentication bypass by spoofing in the internal messaging of BeyondTrust Remote Support, which fails to check where messages come from, letting an attacker with no password upload files and take over the appliance.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-11-02","added":"2026-11-03T22:05:27.736Z","kind":"wider-attacks","text":"Rapid7 updated its post to note that a technical analysis and a public exploit module now exist, which raises the risk for unpatched appliances. Patching does not remove an intruder who got in earlier.","url":"https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild","by":"Rapid7","patch":null},{"at":"2026-10-16","added":"2026-11-03T22:05:27.736Z","kind":"other","text":"The Canadian Cyber Centre issued alert AL26-025 urging self-hosted customers to patch and check appliances for unexpected file activity.","url":"https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-10-16","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities list. Rapid7 reports a federal deadline of 19 October.","url":"https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild","by":"Rapid7","patch":null},{"at":"2026-10-15","added":"2026-11-03T22:05:27.736Z","kind":"new-fix","text":"BeyondTrust published advisory BT26-05 and the BT26-05-RS patch for self-hosted Remote Support 24.3.1 to 26.2.3, and told customers to patch. It confirmed the flaw was used in attacks before disclosure.","url":"https://bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august","by":"BleepingComputer","patch":"patched"},{"at":"2026-10-09","added":"2026-11-03T22:05:27.736Z","kind":"new-fix","text":"BeyondTrust patched all Remote Support and Privileged Remote Access SaaS customers (BleepingComputer gives 8 October; the Canadian Cyber Centre and Rapid7 give 9 October).","url":"https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764","by":"Canadian Centre for Cyber Security","patch":"partial"},{"at":"2026-09-28","added":"2026-11-03T22:05:27.736Z","kind":"other","text":"BeyondTrust contained the compromise of its hosted instance. On 30 September Mandiant shared its findings on the self-hosted case.","url":"https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild","by":"Rapid7","patch":null},{"at":"2026-08-29","added":"2026-11-03T22:05:27.736Z","kind":"disclosed","text":"Two BeyondTrust Remote Support systems, one BeyondTrust-hosted and one self-hosted, were compromised through the flaw, according to BeyondTrust's advisory as summarised by Rapid7. Mandiant ties the campaign to ARMORY CASTLE, a suspected China-linked espionage group.","url":"https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild","by":"Rapid7","patch":"none"}],"url":"https://hard.fyi/live/beyondtrust-remote-support-auth-bypass-oct-2026/","json":"https://hard.fyi/api/live?id=beyondtrust-remote-support-auth-bypass-oct-2026"}