Known exploited vulnerability · BeyondTrust

CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

criticalCVSS 4.0 9.3 · 3.1 9.8Exploited

BeyondTrust Remote Support 26.2.3 and earlier has an authentication bypass that lets an unauthenticated attacker perform file operations on the appliance. It is exploited in the wild and is in CISA's KEV catalog. Self-hosted customers must apply the BT26-05-RS patch (for 24.3.1 through 26.2.3). SaaS instances were patched by 9 October 2026.

Published Oct 15, 2026 · Updated Oct 17, 2026 · Analysis Oct 25, 2026

What an attacker can do

Internal components of Remote Support did not validate the origin of the messages they received (CWE-290, authentication bypass by spoofing). An attacker on the network can send spoofed messages and make the appliance perform file operations, with no credentials and no user interaction.

File writes on a remote access appliance lead to full control. Mandiant, as reported by Rapid7, found a web shell named mangoapi.php (SAWFLY), a tunneler named ingredi_ws (BARECLAW) and persistence under /home/bomgar/sbin/post_boot.d/. Remote Support brokers sessions to endpoints and stores credentials, so a compromised appliance exposes the systems and secrets behind it. Mandiant attributes the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor. Rapid7 dates the first known compromises to 29 August 2026, six weeks before disclosure, so an unpatched or newly patched appliance may already be compromised.

Who is affected

Remote Support 26.2.3 and earlier are affected unless the BT26-05-RS patch is installed. The patch exists for versions 24.3.1 through 26.2.3; older instances must first upgrade to a supported version. BeyondTrust SaaS customers were patched by 9 October 2026 and need no action.

Privileged Remote Access shares the affected code. BeyondTrust recommends patching self-hosted PRA but has not found a way to exploit it there.

Self-hosted customers can confirm the installed patch in the /appliance administration interface.

How to fix it

Apply the BT26-05-RS patch from the /appliance interface. Instances with automatic updates get it on their own; others must install it manually. BeyondTrust ships this as a patch, not a new version number. If your instance is older than 24.3.1, upgrade first, then patch.

CISA's required action is to apply mitigations per vendor instructions under BOD 26-04 and its forensics triage requirements, or to stop using the product if mitigations are unavailable. The due date was 2026-10-19, and it binds US federal agencies.

Patching does not remove an existing foothold. Capture evidence before any reboot. If compromise cannot be ruled out, isolate the appliance, rebuild it from a clean patched image and rotate stored and brokered credentials.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

How to tell if you were hit

Look for the files and artifacts Mandiant reported: mangoapi.php, ingredi_ws, /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, and an unauthorized /uidchanarge route in /ns/config/haproxy.conf. Customers cannot audit the appliance filesystem, so work with BeyondTrust Support.

Review access, syslog, messages, thin-scc, brain and SSL logs. Check for administrative sessions from residential broadband or commercial VPN addresses, unexpected changes to accounts, Jump Items or Teams, and log-forwarding gaps limited to a single session. Absence of these indicators does not prove the appliance is clean.

Original advisory

From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Questions

Is CVE-2026-102764 exploited in the wild?: Yes. CISA added it to the KEV catalog on 16 October 2026. Rapid7 reports compromises of one BeyondTrust-hosted and one self-hosted instance on 29 August 2026, before the vendor disclosed the flaw on 15 October.
Do I need to patch if I use BeyondTrust SaaS?: No. BeyondTrust says it applied the fix to all Remote Support SaaS customers by 9 October 2026. Self-hosted appliances need the BT26-05-RS patch.
Is patching enough?: No. Patching closes the hole but does not remove a web shell or persistence planted earlier. Hunt for the Mandiant indicators, preserve evidence, and rebuild and rotate credentials if you cannot rule out compromise.
Is Privileged Remote Access affected?: It shares the vulnerable code. BeyondTrust recommends patching self-hosted PRA immediately, though it has not identified a way to exploit the flaw there. Confirm the correct patch with BeyondTrust Support.

References

Read for this analysis:

https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remote-support-authentication-bypass-exploited-in-the-wild

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. The analysis is written by an AI model from the sources listed above and checked by automated rules before it is published. Check versions against the vendor's advisory before you act. Methodology

More BeyondTrust vulnerabilities

All BeyondTrust entries