CVE- 2026-102764 is a critical authentication bypass in BeyondTrust Remote Support (RS) that was exploited in the wild before a full disclosure. The flaw allows unauthenticated remote attackers to perform file operations on an affected RS appliance without user interaction. Affected versions are 26.2.3 and earlier unless the BT26-05-RS patch has been applied.
BeyondTrust disclosed the issue on 15 October 2026, and exploitation was confirmed to have occurred prior to disclosure, with two known compromises: one BeyondTrust-hosted instance and one self-hosted appliance, dating back to 29 August 2026. The U.S. CISA subsequently added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) list on 16 October 2026, setting an October 19, 2026, due date for mitigation and recommending forensic triage.
Rapid7 emphasises emergency patching for affected appliances and investigation of RS deployments for prior compromise. Mandiant’s investigation attributes related activity to ARMORY CASTLE (UNC5221), including arbitrary file uploads, use of the SAWFLY web shell, BARECLAW tunneler, root escalation, credential-vault attempts, persistence, and log deletion.
The flaw arises from internal Remote Support components not adequately validating message origins, effectively enabling files operations via spoofed authentication.
Mitigation guidance from BeyondTrust and rapid patching advice are explicit. Apply the BT26-05-RS patch to versions 24.3.1 through 26.2.3; older deployments should upgrade to a patch-supported version before applying the patch. Self-hosted deployments must verify patch installation via the appliance interface, with manual application if automatic updates are disabled; SaaS customers were patched as of 9 October 2026.
Rapid7 also urges investigators to preserve evidence, isolate suspected appliances, and consider rebuilding from patched images, rotating credentials, and reviewing administrative changes and sessions. PRA should be patched as well, though no exploitation method for PRA has been identified. Evidence indicators for hunting include unrecognised admin sessions, unexpected web-directory scripts, unauthorized account or policy changes, and gaps in log forwarding.