BeyondTrust CVE-2026-102764: patched is not the same as clean
BeyondTrust Remote Support zero-day CVE-2026-102764 was exploited from August. The patch closes the hole; it does not remove root access an attacker already got.
BeyondTrust Remote Support CVE-2026-102764 is an authentication bypass that attackers used as a zero-day for about seven weeks before anyone disclosed it. BeyondTrust published its advisory on October 15, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16. If you or your IT provider run a self-hosted Remote Support appliance, the patch is step one. Step two is proving nobody got in before it.
What actually happened
Per Rapid7's analysis of the vendor advisory, Remote Support versions 26.2.3 and earlier are affected unless the BT26-05-RS patch is installed. The patch covers 24.3.1 through 26.2.3. Older appliances must first upgrade to a supported version. BeyondTrust scores the flaw 9.3 under CVSS v4. The first known exploitation was on August 29. BeyondTrust patched its SaaS customers before disclosure. Self-hosted appliances with automatic updates turned off need a manual install.
BleepingComputer reports what Mandiant and Google's threat team saw. The attackers got in through the bypass, planted a web shell, escalated to root, wiped logs, and moved laterally with stolen admin credentials. Google attributes the activity to a suspected China-nexus group it tracks as Armory Castle. Privileged Remote Access shares the affected code, and BeyondTrust recommends patching self-hosted PRA as a precaution. Shadowserver tracks more than 1,400 internet-exposed BeyondTrust remote support instances.
Why it matters for your business
Few small businesses buy BeyondTrust directly. Many use an MSP that does. Remote support appliances store the credentials that get technicians into your machines. Root on the appliance means the attacker has every credential it stores or brokers.
A patch fixes the bug. It does not remove a web shell, restore deleted logs, or revoke stolen passwords. Rapid7's guidance is clear: if an appliance was exposed on a vulnerable build, investigate it, rebuild it if you cannot rule out compromise, and rotate the credentials it holds.
Ask your provider three questions in writing. Do you run BeyondTrust Remote Support or PRA for our account? When was BT26-05-RS installed? What did you check for compromise, and which credentials did you rotate?
Key takeaways
- CVE-2026-102764 is an authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier
- It was exploited from August 29; the advisory came October 15 and CISA added it to KEV on October 16
- The fix is patch BT26-05-RS; self-hosted appliances without auto-update need a manual install
- Attackers reached root, planted web shells, and wiped logs, so a patched appliance can still be compromised
- Rotate every credential the appliance stored or brokered if it was exposed on a vulnerable build
Your remote-access vendor holds the keys to every machine you own. We map which tools have standing access to your network, who patches them, and which credentials they hold. Start with your vendor list or see how we scope it.
Sources: Rapid7, BleepingComputer, Canadian Centre for Cyber Security.
- #beyondtrust
- #cve-2026-102764
- #remote-access
- #cisa-kev
- #msp-security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Plex2Shell: update Plex Media Server, then check for miners
Plex2Shell chains four Plex Media Server flaws into remote code execution. CISA lists it as exploited. Update to 1.43.3.10861 and check the box for implants.
Read itCopilot usage metrics API now names your MCP servers and agents
GitHub's Copilot usage metrics API now reports MCP servers, custom agents and skills by name, not as 'other'. Use it to audit what your AI coding fleet runs.
Read it