CVE-2026-102764: BeyondTrust Remote Support Bypass
Active exploitation confirmed in CISA KEV.
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-16. Federal agencies must patch by 2026-10-19.
TL;DR - CVE-2026-102764 is a critical authentication-bypass flaw in BeyondTrust Remote Support 26.2.3 and earlier. - CISA confirms active exploitation and lists it in KEV; apply BT26-05-RS immediately. - Investigate exposed appliances for compromise, even if no public proof of concept is available.
Summary
CVE-2026-102764 is a CWE-290 authentication bypass by spoofing vulnerability in internal components of BeyondTrust Remote Support, formerly known as Bomgar. The flaw involves inadequate validation of message origin. An unauthenticated remote attacker can submit spoofed messages that the appliance accepts as trusted, enabling file operations without user interaction.
Exploitation has been confirmed in the wild. CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog on October 16, 2026, with a remediation due date of October 19, 2026. Organizations with internet-accessible, unpatched appliances should treat them as potential incident-response cases, not ordinary patching tasks.
For background on how security teams should approach infrastructure hardening, see our guide to Docker container hardening. Although the technologies differ, the same principles—asset inventory, exposure reduction, patch verification, and post-remediation monitoring—apply.
| Field | Detail |
|---|---|
| CVE | CVE-2026-102764 |
| Product | BeyondTrust Remote Support, formerly Bomgar |
| CVSS | 9.8 in the NVD API record; CNA-reported CVSS v4.0 score: 9.3 Critical |
| Attack vector | Network |
| Authentication / privileges required | None |
| User interaction | None |
| Patch available | Yes, through BeyondTrust advisory BT26-05 and patch BT26-05-RS |
| Affected versions | Remote Support 26.2.3 and earlier, unless BT26-05 has been applied |
| CWE | CWE-290, Authentication Bypass by Spoofing |
| CISA KEV | Yes, added October 16, 2026 |
| Public PoC | None identified in the reviewed sources |
| Active exploitation | Confirmed; activity attributed to ARMORY CASTLE |
Analyst’s Take: The first priority is to identify internet-accessible Remote Support appliances running 26.2.3 or earlier and move them into incident triage. A patch closes the vulnerability, but it does not answer whether an exposed appliance was already accessed, so preserve relevant logs and review activity around the known exploitation window.
Root Cause
The root cause is an origin-validation failure in an internal messaging component. Components within Remote Support did not adequately verify that received messages originated from an authorized or trusted source. This creates an authentication boundary failure: an attacker can spoof messages that the appliance processes as legitimate internal instructions.
The vulnerability is classified as CWE-290, Authentication Bypass by Spoofing. Successful exploitation does not depend on convincing an employee to open a file or approve a request. The reported conditions allow a remote, unauthenticated attacker to interact with the appliance and perform file operations. The available research does not establish that every internal component or deployment configuration is exploitable in exactly the same way, so defenders should rely on the vendor’s affected-version guidance rather than attempting to infer safety from local configuration alone.
Technical Notes
The technical issue is not described as a conventional user-password bypass involving stolen credentials. It is an authentication trust failure between internal components or message-handling paths. Rotating administrator passwords alone does not remediate the vulnerability.
Because exploitation can occur without privileges or user interaction, controls that depend on authenticated administrative access, endpoint prompts, or user awareness are insufficient. Network segmentation and access restrictions may reduce exposure, but the required corrective action is installation of the vendor patch or an upgrade to a supported release followed by patching.
Who’s Exposed
Confirmed affected systems are self-hosted BeyondTrust Remote Support appliances running version 26.2.3 or earlier, unless the applicable BT26-05 patch has already been installed. The affected product was formerly marketed as Bomgar, so asset inventories and older documentation may identify the platform under either name.
Remote Support versions from 24.3.1 through 26.2.3 are covered by the BT26-05-RS remediation path. Deployments older than 24.3.1 must first be upgraded to a supported release before the security patch can be applied. An older major release or a management interface that is not broadly exposed does not establish that a system is protected.
BeyondTrust Privileged Remote Access shares affected code. BeyondTrust reported that its internal testing did not identify an exploitable path in PRA, but released a precautionary patch and recommends that self-hosted PRA customers apply it. That assessment does not eliminate the need to inventory and patch PRA systems where the vendor’s advisory applies.
BeyondTrust reported that its Remote Support SaaS customer instances had been patched by October 9, 2026. SaaS customers should still confirm remediation with BeyondTrust or through the service administration interface, retain confirmation for audit purposes, and investigate suspicious activity if their instance was exposed before provider-side remediation.
Severity Breakdown
The NVD API record reports a CVSS score of 9.8. The vendor-provided CVSS v4.0 vector, reported by NVD, is:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVD indicates that it did not provide an independent CVSS assessment; the CVSS v4.0 rating was supplied by BeyondTrust as the CVE Numbering Authority. The vendor-reported CVSS v4.0 score is 9.3, categorized as Critical. The difference between the values should be recorded in vulnerability-management systems rather than treated as a contradiction: they represent different scoring records or versions, while both indicate severe risk.
| Component | Value | Operational meaning |
|---|---|---|
| Attack Vector | Network | The attacker can reach the vulnerable service over a network |
| Attack Complexity | Low | No unusual or difficult conditions are required once the target is reachable |
| Attack Requirements | None | No additional precondition is identified in the supplied vector |
| Privileges Required | None | The attacker does not need an account or existing authorization |
| User Interaction | None | A user does not need to click, approve, or open anything |
| Vulnerable confidentiality | High | Unauthorized file operations may expose sensitive information |
| Vulnerable integrity | High | An attacker may alter files or appliance data |
| Vulnerable availability | High | Appliance operations or data may be disrupted |
| Subsequent-system impact | None in vector | The score does not assign direct impact to subsequent systems |
The score alone understates the operational urgency because exploitation has already been observed. Internet exposure, appliance administrative privileges, stored remote-support data, and the system’s role in privileged access workflows can substantially increase the consequences of compromise.
Exploitation Status
Exploitation is confirmed in the wild. CISA added CVE-2026-102764 to KEV, which means the agency has evidence that the vulnerability is being exploited. Reported activity attributed to ARMORY CASTLE began as early as August 29, 2026, before public disclosure.
Reportedly affected infrastructure included one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Reported attacker objectives included initial access, persistence, privilege escalation, and lateral movement. The available research does not establish that every exploitation event used identical tooling or that every affected appliance was compromised successfully.
No public proof-of-concept exploit was identified in the reviewed sources as of this article’s update date. That absence is not a meaningful safety indicator. Threat actors have already demonstrated operational exploitation, and a public PoC is not required for defenders to treat unpatched systems as high risk.
The available research does not identify ransomware campaign use as confirmed. CISA’s KEV information marks ransomware campaign use as unknown. Organizations should therefore avoid describing the vulnerability as ransomware-specific while still investigating for persistence, credential access, lateral movement, and unauthorized file activity.
Sources
The primary technical and remediation references are the NVD record and BeyondTrust’s BT26-05 advisory and incident analysis. NVD provides the CVE record, affected-product context, and the CNA-reported CVSS information. BeyondTrust provides the product-specific patch guidance and information about Remote Support and PRA.
CISA’s KEV catalog and alert establish the exploitation status and urgency. KEV inclusion confirms exploitation in the wild; it is not merely a prediction that exploitation could occur. Additional context on exploitation and remediation is available from Rapid7 and Beazley.
- NVD: CVE-2026-102764
- BeyondTrust BT-26-05 advisory and incident analysis
- BeyondTrust customer advisory reference
- CISA KEV catalog: CVE-2026-102764
- CISA alert on BeyondTrust Remote Support
- Rapid7 analysis
- Beazley security advisory
Treat CVE-2026-102764 as an active incident-risk vulnerability. Patch Remote Support immediately, confirm the patch state, and investigate exposed appliances without waiting for a public proof of concept.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should combine asset validation, appliance telemetry, identity events, file activity, and network monitoring. Begin by identifying every Remote Support and PRA appliance, recording whether it is self-hosted or SaaS, its exact version, internet exposure, and patch state. Any internet-accessible Remote Support appliance at version 26.2.3 or earlier should be placed into an incident triage workflow until patching and review are complete.
Review appliance authentication and administrative logs for unexpected access, unusual source addresses, new or modified administrative objects, changes outside maintenance windows, and activity that predates public disclosure. Inspect file-operation logs and appliance-integrity records for unexplained reads, writes, uploads, downloads, deletions, or changes to configuration and support-session data. Preserve logs before rebuilding or resetting a potentially compromised appliance.
Technical Notes
The supplied research does not publish a stable exploit-specific network signature, URI, payload, or vendor-defined event identifier. Do not invent a Snort or Suricata rule based only on the CVE number. Instead, correlate authentication, administrative, file-operation, and outbound-connection telemetry around affected appliances.
A generic SIEM query pattern can help locate suspicious activity, but field names must be adapted to the appliance and log pipeline:
index=remote_support
| where product IN ("BeyondTrust Remote Support", "Bomgar")
| where event_time >= "2026-08-29"
| where action IN ("file_read", "file_write", "file_upload",
"file_download", "file_delete", "admin_change")
| where isnull(user) OR user="" OR authentication_result IN ("none", "bypass", "failed")
| stats count min(event_time) max(event_time)
values(source_ip) values(destination) values(object)
by appliance, action, authentication_result
Network teams should review connections to Remote Support appliances from unexpected geographic locations, hosting providers, cloud addresses, or internal segments that do not normally administer the service. They should also examine new outbound connections from the appliance after suspicious file or administrative events. Because no validated public signature is provided, an absence of a matching signature must not be interpreted as evidence that the appliance is clean.
Remediation Steps
Apply BeyondTrust security advisory BT-26-05, specifically patch BT-26-05-RS for Remote Support. The patch is available for supported Remote Support versions 24.3.1 through 26.2.3. Administrators should verify completion through the appliance administration interface and retain the resulting version or patch evidence.
Deployments older than 24.3.1 must first be upgraded to a supported release before applying BT-26-05-RS. The research note does not identify a single universal target version beyond the supported release requirement, so administrators should use BeyondTrust’s current supported-release guidance and the appliance’s upgrade workflow rather than selecting an unverified version.
# Example operational sequence; use the appliance's supported
# BeyondTrust administration workflow and approved maintenance process.
1. Record the current Remote Support version and appliance identifier.
2. Confirm whether the deployment is self-hosted or SaaS.
3. If self-hosted and below 24.3.1, upgrade to a supported release.
4. Apply BT-26-05-RS through the BeyondTrust appliance administration interface.
5. Verify the installed patch and resulting version in the administration interface.
6. Export or retain patch evidence for change management and incident response.
There is no documented workaround in the supplied sources that provides equivalent protection to BT-26-05-RS. If immediate patching is impossible, restrict network access to trusted administration and service networks, remove unnecessary internet exposure, monitor all access closely, and coordinate with BeyondTrust. These measures are compensating controls only and should not be treated as remediation.
For systems that cannot be mitigated, CISA directs stakeholders to discontinue use of the product where mitigations are unavailable. This is especially relevant to appliances that are internet-accessible, unsupported, or unable to receive the required patch. Before rebuilding or resetting a suspicious appliance, preserve forensic evidence and follow applicable CISA forensic-triage guidance.
After patching, investigate whether the appliance was exposed during the known exploitation window. Review authentication logs, file operations, administrative changes, outbound network traffic, persistence mechanisms, and accounts associated with the appliance. If compromise is suspected, isolate the system, preserve evidence, rotate credentials and tokens that may have been exposed, and assess lateral movement into connected systems.
Organizations reviewing broader credential exposure after a Remote Support incident may also benefit from a structured comparison of password managers for individuals in 2026. Password-manager selection does not remediate this vulnerability, but strong, unique credentials can reduce secondary account risk during incident recovery.