BeyondTrust Remote Support login bypass CVE-2026-102764 exploited since August; patch BT26-05-RS
BeyondTrust Remote Support has a critical login-bypass flaw (CVE-2026-102764) attackers used from late August. Cloud customers are already patched. Self-hosted IT teams should apply BT26-05-RS now and check for earlier compromise.
If your business runs a self-hosted BeyondTrust Remote Support or Privileged Remote Access appliance, apply the BT26-05-RS patch now (upgrade first if older than 24.3.1), and ask your IT provider to check for earlier compromise and rotate stored credentials. Cloud-hosted customers need do nothing. Families don't normally run this product.
What’s happening
BeyondTrust Remote Support, a tool IT teams use to remotely control computers, has a critical flaw that lets an attacker with no password perform file operations on the server and take it over. BeyondTrust says it was used in attacks before it was known: two systems, one hosted by BeyondTrust and one self-hosted, were compromised from 29 August 2026. Mandiant links the activity to ARMORY CASTLE, a suspected China-linked espionage group, which installed a web shell, escalated to root, wiped logs and sought stored credentials. BeyondTrust patched its cloud customers by 8 or 9 October (sources differ) and published advisory BT26-05 with the BT26-05-RS patch on 15 October. The patch covers self-hosted versions 24.3.1 to 26.2.3; older ones must be upgraded first. CISA listed the flaw as exploited on 16 October. Rapid7 reports that technical analysis and a public exploit module now exist. Patching does not remove an attacker already inside, so exposed appliances should be investigated.
- What
- Flaw
- Affects
- BeyondTrust Remote Support (and Privileged Remote Access) self-hosted appliances
- Affected
- BeyondTrust Remote Support 26.2.3 and earlier (self-hosted)
BeyondTrust Privileged Remote Access (self-hosted; shares the affected code, no exploit path found by BeyondTrust) - Fixed in
- BT26-05-RS patch for Remote Support 24.3.1 to 26.2.3
SaaS tenants patched by BeyondTrust by 8 to 9 October 2026 - Since
- 15 Oct 2026
Timeline
- Wider attacks
Rapid7 updated its post to note that a technical analysis and a public exploit module now exist, which raises the risk for unpatched appliances. Patching does not remove an intruder who got in earlier.
- Update
The Canadian Cyber Centre issued alert AL26-025 urging self-hosted customers to patch and check appliances for unexpected file activity.
- CISA added
CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities list. Rapid7 reports a federal deadline of 19 October.
- New fixFixed
BeyondTrust published advisory BT26-05 and the BT26-05-RS patch for self-hosted Remote Support 24.3.1 to 26.2.3, and told customers to patch. It confirmed the flaw was used in attacks before disclosure.
- New fixPartly fixed
BeyondTrust patched all Remote Support and Privileged Remote Access SaaS customers (BleepingComputer gives 8 October; the Canadian Cyber Centre and Rapid7 give 9 October).
- Update
BeyondTrust contained the compromise of its hosted instance. On 30 September Mandiant shared its findings on the self-hosted case.
- Made publicNo fix yet
Two BeyondTrust Remote Support systems, one BeyondTrust-hosted and one self-hosted, were compromised through the flaw, according to BeyondTrust's advisory as summarised by Rapid7. Mandiant ties the campaign to ARMORY CASTLE, a suspected China-linked espionage group.
Sources
- BeyondTrust security advisory BT26-05BeyondTrust · 15 Oct 2026
- Alert AL26-025: Critical vulnerability impacting BeyondTrust Remote SupportCanadian Centre for Cyber Security · 16 Oct 2026
- CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildRapid7 · 2 Nov 2026
- BeyondTrust patches zero-day exploited in attacks since AugustBleepingComputer · 15 Oct 2026