CVE-2026-102764: is your BeyondTrust Remote Support exposed from the outside?

What is CVE-2026-102764?

A missing origin check inside BeyondTrust Remote Support that turns into file upload, root and the appliance's credential store. The CVE record says internal components "did not adequately validate the origin of the messages" they received, which "could allow an attacker to perform file operations on the appliance." Mandiant adds that it allows an unauthenticated remote attacker to upload arbitrary files, which can lead to host-level control and access to every credential the appliance stores or brokers.

BeyondTrust is withholding the technical details while self-hosted customers patch. That is the right call, and it is why this page has none either.

What Mandiant documented after initial access, at a high level:

When was it disclosed, and was it exploited before the patch?

Yes. Exploitation started 40 days before the patch and 47 days before public disclosure.

One line in BeyondTrust's write-up deserves more attention than it got. Its sensors fired in real time when the actor escalated privileges, and the automated triage in its third-party detection platform closed those alerts as false positives. The intrusion was found weeks later by a threat-intel-driven hunt. If a security vendor hunting its own fleet can lose a month that way, plan for it in yours.

The next phase is predictable. BeyondTrust and Mandiant both expect what this actor usually does once a vulnerability is public: move from a few chosen targets to every unpatched appliance it can reach. That is also the pattern in our KEV analysis: the 2026 CVEs that CISA confirmed as exploited on the day they were published are mostly network and security appliances. This one took a single day.

Does it matter for you? Three questions

If all three answers are yes, treat it as an incident until a forensic review says otherwise.

1. Is it exposed? Remote Support is built to be reached by customers and technicians from anywhere, so the appliance itself is usually internet-facing. The sharper question is which parts answer from the internet: the customer portal, or also /login and /appliance.
2. Is it exploited? Yes, by a state-linked espionage actor, with a CISA KEV listing. That puts it ahead of anything that is only vulnerable on paper.
3. Is it exploitable here? Self-hosted Remote Support up to 26.2.3 without the BT26-05-RS patch: yes. Version 26.3.1 and later: fixed. SaaS: patched by BeyondTrust. Privileged Remote Access: no known exploitation path, but it shares the code, so patch it.

How do you check exposure from the outside without exploiting anything?

Find the appliance, see which interfaces answer from the internet, and confirm the patch from the inside. No exploit traffic needed.

• Find every appliance. The hostname your customers use for support sessions is the obvious one. Also check DNS, certificate transparency logs and your attack surface tool for old or regional instances, and for Privileged Remote Access appliances.
• Load /login and /appliance from outside. From a network outside your perimeter, open both paths in a browser. If either shows a sign-in page, it is reachable from the internet, and Mandiant's guidance is to restrict both by IP or network segment. That is a finding whatever the patch status.
• Confirm the patch from a trusted network. In the /appliance interface, check that BT26-05-RS is applied or the appliance runs Remote Support 26.3.1 or later. Appliances older than 24.3.1 have to upgrade to a supported version first.
• Write down the window. If an unpatched appliance answered from the internet between August 29 and the day you patched, that is your exposure window for the forensic review.

BeyondTrust's product had a security team, a detection stack and Mandiant working alongside it. The product has a million eyes on it. Whether your /appliance page answers a stranger on the internet is a question that usually has none.

How do you fix it, and what if you were already exposed?

Patch first. Then, if you were exposed, preserve evidence, rebuild rather than clean, and rotate credentials only after the appliance is trustworthy again.

1. Patch. Apply BT26-05-RS from /appliance on supported versions, or upgrade Remote Support to 26.3.1 or later. Patch self-hosted PRA too.
2. Preserve evidence. Snapshot virtual appliances with memory before changing anything, and collect syslog, reverse proxy, WAF and firewall logs for the whole window.
3. Rebuild if in doubt. Redeploy from a clean, fully patched image, and restore only a configuration backup from before the window.
4. Rotate in order. Appliance admin, /login users, API secrets, directory bind accounts, vault and PRA credentials, then integrations. Rotating before the rebuild hands the new secrets to whoever is still inside.
5. Reduce exposure. Restrict /login and /appliance, allow outbound traffic only where the appliance needs it, require SAML SSO with phishing-resistant MFA, and set the default Jump Item role to No Access.
6. Get the logs off the box. This actor deletes local logs. Forward syslog to your SIEM and keep months of it.

For hunting, Mandiant and BeyondTrust point at behavior over indicators: role changes on Jump Items or Teams, admin logins from residential or commercial VPN addresses, unknown .php files in the web root, WebSocket upgrades to unfamiliar paths at the proxy, and gaps in log forwarding. Mandiant's post has the file hashes and YARA rules.

Sources

1. BeyondTrust, ARMORY CASTLE and BT26-05: What Security Teams Need to Know (October 15, 2026, updated October 16, 2026)
2. BeyondTrust, Security Advisory BT26-05 (updated November 4, 2026)
3. Mandiant / Google Threat Intelligence Group, ARMORY CASTLE Exploits BeyondTrust (October 16, 2026)
4. CISA, Known Exploited Vulnerabilities Catalog, catalog version 2026.10.30
5. CVE Program, CVE-2026-102764; NIST NVD, CVE-2026-102764
6. Rapid7, CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild (October 19, 2026)
7. Cylent, Time to exploit in 2026 (CISA KEV analysis, updated monthly)