About:
CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support that is being actively exploited in the wild. The flaw allows an unauthenticated attacker to perform file operations on vulnerable appliances and has been used to deploy web shells and gain control of affected systems. Organizations should immediately apply the BT26-05-RS patch and investigate self-hosted appliances for signs of compromise.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
Identifier: CVE-2026-102764
PoC or Exploitation: Confirmed actively exploited.
CVSS Score: 9.3 (Critical, CVSS v4.0)
Update / Patch:
BeyondTrust has released the BT26-05-RS patch. No other workaround is described.
Affected versions include:
BeyondTrust Remote Support, all versions up to and including 26.2.3
Fixed versions include:
BT26-05-RS patch for Remote Support versions 24.3.1 through 26.2.3
Self-hosted customers apply the patch from the appliance interface if their instance is not subscribed to automatic updates. Self-hosted customers on a version older than 24.3.1 must first upgrade to a newer version, then apply the patch. BeyondTrust-hosted Remote Support instances were patched as of October 9, 2026, and need no customer action.
Privileged Remote Access shares the affected code. BeyondTrust's advisory lists only Remote Support as impacted, and its internal testing found no way to exploit the flaw in Privileged Remote Access. BeyondTrust released the patch for Privileged Remote Access as a precaution and recommends that self-hosted customers apply it.
BeyondTrust Security Advisory BT26-05:
https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
Description:
CVE-2026-102764 is an authentication bypass by spoofing vulnerability in BeyondTrust Remote Support.
A remote attacker can exploit this flaw to perform file operations on an affected appliance. No privileges are required. In the intrusions BeyondTrust describes, the attacker used it to plant a web shell and take control of the appliance. A Remote Support appliance stores and brokers privileged credentials across an environment.
Mitigation Recommendation:
Apply the BT26-05-RS patch to every self-hosted Remote Support appliance.
Limit external access to the appliance to the services that users and customers need. Restrict administrative interfaces to trusted networks, and restrict the appliance's outbound traffic to required destinations.
Forward appliance syslog and session events to the SIEM in near real time.
Investigate every self-hosted appliance for compromise.
Isolate any appliance suspected of compromise. Capture a snapshot of a virtual appliance or a forensic image of a physical one before rebuilding. Collect web application firewall, reverse-proxy, and perimeter firewall logs for the exposure window.
Rebuild a compromised appliance from a known-good state, and apply the patch. Rotate every credential the appliance stored or injected, and revoke all active support sessions. Review new multifactor authentication registrations on privileged accounts.
Engage BeyondTrust if you find evidence of exploitation. Open a Severity 1 support request that cites BT26-05. BeyondTrust also offers customers a threat hunting package for this actor through its trust portal.