CVE-2026-102764: BeyondTrust RS Actively Exploited

CVE-2026-102764 (CVSS 9.3, EPSS ≥ 67th pct) is a critical authentication-bypass flaw affecting BeyondTrust Remote Support (RS). The vulnerability stems from improper origin validation in an internal messaging component, and exploitation allows an unauthenticated remote attacker to perform file operations on an affected appliance. The CVE was published on October 15th, 2026, and added to CISA’s KEV list the next day. In a reported campaign, attackers were able to gain admin access to the RS application and pivot to managed endpoints to steal sensitive data.

No detailed root-cause analysis or proof-of-concept (PoC) exploits are publicly available for CVE-2026-102764. Numerous national CERT agencies have issued alerts for CVE-2026-102764 and related attack campaigns [1][2][3][4][5][6][7][8]. Furthermore, BeyondTrust vulnerabilities have been featured several times on the Greenbone blog, including a December 2024 breach of the U.S. Treasury Department and ransomware attacks earlier in 2026 [9][10][11].

A Global Risk Assessment of CVE-2026-102764 in BeyondTrust Remote Support

CVSS 9.3 · CriticalEPSS 1.2% (67th)Exploited as zero-dayIn CISA KEV

In general, CVE-2026-102764 can be exploited by an unauthenticated attacker with network access to an affected device. Forensic evidence shows how the vulnerability was used as the initial access point for lateral intrusions and sensitive data theft. According to Mandiant, CVE-2026-102764 was exploited as a zero-day in late August 2026. Risk is elevated because BeyondTrust RS is an enterprise service-desk and remote-access platform. These capabilities increase the operational significance of a breach because successful exploitation gives access to infrastructure used for privileged remote-access.

BeyondTrust RS is a known target for sophisticated cyber adversaries [1][2][3], and CVE-2026-102764 is the product’s second CISA KEV entry of 2026. The previous entry, CVE-2026-1731 (CVSS 9.8), is associated with ransomware attacks. Although no PoC exploits are publicly available, a GitHub repository claims to offer private access to one. Defenders should prioritize patching of internet-exposed and internally reachable self-hosted appliances.

The Technical Details for CVE-2026-102764 in BeyondTrust Remote Support

No detailed root-cause analysis is available for CVE-2026-102764. The flaw is described as inadequate validation of message origin inside an internal messaging component, leading to authentication-bypass-by-spoofing [CWE-290]. Successful exploitation allows file operations on the appliance, including arbitrary file upload.

ARMORY CASTLE Exploitation Campaign

According to Mandiant, ARMORY CASTLE (formerly tracked as UNC5221) exploited CVE-2026-102764 as a zero-day in late August 2026. The flaw was leveraged to gain a foothold on BeyondTrust RS appliances, establish persistence [TA0003], escalate privileges [TA0004], and move laterally [TA0008]. Ultimately, the attacks led to exfiltration of sensitive information from managed endpoints.

The SAWFLY PHP-based web shell [T1505.003] and BARECLAW SOCKS5 proxy tunneler are novel strains of malware observed during post-exploitation activity. Attackers also leveraged living-off-the-land (LoTL) techniques, and deletion of appliance logs [T1685.006] and other artifacts [T1070.004] to evade detection.

After initial access, attackers attempted to steal credentials [T1555] via the device’s native /ns/sbin/bt-secrets binary and subsequently logged into the RS application [T1078]. The compromised account’s Jump Items and Team permissions were elevated to Administrator [T1098], allowing access to remote downstream systems. Attackers then used BeyondTrust’s own remote management tools [T1219] to exfiltrate sensitive documents [TA0010] from the remote endpoints. Attackers also modified the device’s HAProxy configuration to expose the BARECLAW WebSocket-based SOCKS5 proxy over the appliance’s public-facing interface [T1090] for command and control (C2) [TA0011].

Affected Versions and Mitigation for CVE-2026-102764 in BeyondTrust Remote Support

Organizations using self-hosted deployments of BeyondTrust RS must manually install the BT26-05-RS patch if automatic updates are not enabled. The BT26-05-RS patch applies to versions 24.3.1 through 26.2.3. For versions older than 24.3.1, users must first upgrade before applying the patch. According to BeyondTrust, although Privileged Remote Access (PRA) shares the vulnerable code segment, the vendor has not identified an exploitable path in PRA. However, BeyondTrust has released a precautionary patch and recommends that self-hosted PRA customers apply it immediately.

CISA has flagged CVE-2026-102764 for forensic triage, and patching should be paired with a compromise assessment. Appliances should be inspected for signs consistent with reported activity, including unrecognized files, changes to session-policy or account permissions, unrecognized account activity, presence of a web shell and related activity, WebSocket-based SOCKS5 tunneling, and unexplained log deletion.

Product	Affected versions	Fixed versions	Notes
BeyondTrust Remote Support self-hosted	All versions <= 26.2.3	BT26-05-RS patch for versions 24.3.1 through 26.2.3	Versions older than 24.3.1 must be upgraded before the patch can be applied.

Summary

CVE-2026-102764 is a critical-severity, remotely exploitable authentication-bypass vulnerability in BeyondTrust RS. The flaw has been actively exploited to establish persistence on a vulnerable device, escalate privileges, move laterally to managed endpoints within the victim’s network, and steal sensitive data. Defenders should urgently identify self-hosted BeyondTrust Remote Support appliances, upgrade to a patched version, and assess appliances for indicators of compromise.