BeyondTrust Remote Support: actively exploited zero-day (CVE-2026-102764), patch BT26-05-RS
Published 26/10/2026 10:54
Timeline
4 events over 10 d
- 16/10/2026 01:35Unconfirmed reportCommunity post+24 min
- 16/10/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 16/10/2026ExploitedCISA Known Exploited Vulnerabilities+10 d
- 26/10/2026 10:54Published on WatchtowerPro CISO
In short
CVE-2026-102764 is a critical flaw (CVSS 9.3) in self-hosted BeyondTrust Remote Support. An unauthenticated attacker can perform file operations on the appliance over the network. It has been exploited since 29/08/2026 and is on CISA's KEV list. Apply patch BT26-05-RS, check your appliance for compromise, and rebuild it if you find any.
Affected versions
- Self-hosted BeyondTrust Remote Support (RS), all versions up to and including 26.2.3.
- BeyondTrust-hosted (SaaS) Remote Support has already been patched, according to CISA.
- Privileged Remote Access (PRA) exposure is not confirmed. watchTowr says BT26-05 patches cover RS and PRA appliances, but its affected-versions table lists only Remote Support.
Fixed in
- BeyondTrust patch BT26-05-RS for self-hosted Remote Support. Versions 26.2.3 and earlier are affected unless this patch has been applied. No new version number has been published for the fix.
What to do now
- Before patching, preserve evidence: save logs, configuration files and system images, because patching can overwrite evidence. watchTowr lists these logs to review: access, syslog, messages, thin-scc, brain and SSL. They sit on an encrypted partition, so BeyondTrust may need to help read them.
- Apply the BT26-05-RS patch as soon as possible. It applies to self-hosted versions 24.3.1 through 26.2.3. If you run a version older than 24.3.1, upgrade to a newer version first. No fixed version number has been published in the sources.
- Interim measures only reduce exposure and do not make a server safe. Limit external access to the services users and customers need, and restrict administrative interfaces to trusted networks. No vendor setting names or values are given in the sources.
- Hunt for compromise: look for unfamiliar files in web directories, new admin accounts, and odd startup scripts or sudoers changes.
- If compromise is suspected, rebuild the appliance from a known-good state and apply the patch. Rotate every credential the appliance stored or injected, revoke all active support sessions, and review new MFA registrations on privileged accounts.
- If your Remote Support is BeyondTrust-hosted (SaaS), no patching is needed because CISA says it has already been patched.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 7 open questions, followed up as sources answer and all 8 sources with their dates. And technology matching: which of your systems run BeyondTrust Remote Support / PRA, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: BeyondTrust Remote Support - BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability Vendor · NCSC-2026-0437 [1.00] [H/H] Kwetsbaarheid verholpen in BeyondTrust Remote Support CERT · BSI (Mastodon) CERT