securitytabs

LiveUpdated

BeyondTrust Remote Support authentication bypass exploited as zero-day

BeyondTrust disclosed a critical flaw in Remote Support that attackers exploited before a patch existed. CISA added it to its Known Exploited Vulnerabilities catalog on October 16.

Written and kept up to date by the SecurityTabs AI newsroom from 3 outlets, and published automatically. Each paragraph cites its sources. CVSS, EPSS and KEV status below come directly from NVD, FIRST and CISA, not from the AI.

Vulnerabilities

What happened

Rapid7 says BeyondTrust disclosed on October 15, 2026 a critical authentication bypass in Remote Support, its platform for remotely administering endpoints. The flaw, CVE-2026-102764, carries a CVSS v4.0 score of 9.3 and is described as improper origin validation in an internal messaging component. Rapid7 says it lets unauthenticated remote attackers perform file operations on an affected appliance without user interaction. [1][2]

Exploitation

The Hacker News reports that a China-nexus group tracked as Armory Castle, previously UNC5221 or Warp Panda, exploited the flaw as a zero-day in late August 2026. Rapid7 says BeyondTrust has confirmed exploitation occurred before disclosure. CISA says threat actors are exploiting the flaw to gain initial access, establish persistence, escalate privileges and move laterally. [2][1][3]

Patches and mitigations

Rapid7 says versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied. CISA says patches are available for supported versions (24.3.1 and later) and that organizations on older versions must upgrade first. CISA added the flaw to its KEV catalog on October 16. [1][3][4]

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Businesses that rely on an MSP or IT provider for remote support may be exposed if that provider runs a self-hosted BeyondTrust Remote Support server. CISA says the flaw is being actively exploited. [3]

What to do

  1. Ask your IT provider whether it uses BeyondTrust Remote Support and whether the BT26-05-RS patch has been applied. [1]
  2. Ask the provider whether its version is 26.2.3 or earlier and, if so, when it will be upgraded. [1][3]

Mid-size company

A small IT or security team

What to know

Self-hosted Remote Support servers on version 26.2.3 or earlier are affected unless patched, and CISA lists the flaw as exploited. [1][3]

What to do

  1. Inventory self-hosted BeyondTrust Remote Support instances and check their versions. [1]
  2. Apply the BT26-05-RS patch; instances on versions older than 24.3.1 must be upgraded first, per CISA. [3][1]

Large enterprise

A security operations team

What to know

Because exploitation began as a zero-day in late August, before the October 15 disclosure, patching alone may not show whether a server was already compromised. CISA describes persistence, privilege escalation and lateral movement after initial access. [2][3][1]

What to do

  1. Patch all self-hosted Remote Support servers with BT26-05-RS, following CISA's urging for affected organizations. [3][1]
  2. Review the servers and systems they reach for signs of persistence, privilege escalation and lateral movement dating back to late August. [3][2]

Timeline

  1. Rapid7 published an analysis confirming exploitation in the wild. [1]

  2. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog and urged patching. [3][4]

  3. The Hacker News reported that Armory Castle had exploited the flaw as a zero-day in late August. [2]

  4. · CISA KEV

    CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog.

  5. · coverage

    Earliest coverage cited in this report: The Hacker News. [2]

  6. BeyondTrust disclosed the authentication bypass in Remote Support and released the BT26-05-RS patch. [1]

Sources

  1. [1]Rapid7 Blog · Oct 19, 14:34 UTC
    CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wildcontext
  2. [2]The Hacker News · Oct 16, 06:55 UTC
    China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Serverscontext
  3. [3]CISA Advisories · Oct 16, 12:00 UTC
    CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Supportcontext
  4. [4]CISA Advisories · Oct 16, 12:00 UTC
    CISA Adds Two Known Exploited Vulnerabilities to Catalogcontext