CVE-2026-102764

Remote Support is remote-access software that lets IT staff connect to and fix computers from afar — like a repairperson who can remotely jiggle the locks on your office door. This flaw means an outside attacker can trick the system into opening that door themselves, no key or login needed, and then plant tools to come back later or move deeper into your network.

This matters to you if your business uses BeyondTrust Remote Support, either as a self-hosted appliance or through a managed service provider that relies on it for remote IT support. Exposure depends on whether the appliance can be reached from the internet — appliances that are internet-facing are the ones attackers have been targeting.

Attackers are already exploiting this vulnerability in real-world attacks, starting as a zero-day in August 2026, to gain initial access, escalate to root privileges, and install malware — this is confirmed, not theoretical. CISA has ordered federal agencies to remediate by October 19, 2026, and every organization running this product should treat that same deadline as the bar to clear. Do not wait — act now.

Confirm your deployment model first: SaaS customers of BeyondTrust Remote Support were already patched by the vendor as of October 9, 2026, so verify with BeyondTrust or your account team that your tenant received that fix. For self-hosted/on-premise appliances, apply the remediation described in vendor advisory BT26-05 immediately; if a patch cannot be applied before CISA's October 19, 2026 due date, isolate the appliance from the internet or disable it per CISA BOD 26-04 guidance (discontinue use if no mitigation is available). There is no documented workaround beyond network isolation — restrict inbound access to the messaging components to trusted management networks only as an interim measure. Given confirmed exploitation involving the Sawfly web shell and Bareclaw tunneler, review appliance and network logs back to August 29, 2026 for unauthorized file writes, unexpected web shell artifacts, unusual outbound tunneling traffic, and signs of root-level privilege escalation; engage incident response/forensics per CISA's Forensics Triage Requirements if any indicators are found.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — remote, unauthenticated, no user interaction, full compromise of confidentiality, integrity and availability. Root cause is CWE-290 (Improper Origin Validation) in internal messaging components, allowing crafted messages from an untrusted source to trigger arbitrary file operations on the appliance. Confirmed in-the-wild exploitation (KEV-listed, added 2026-10-16, CISA due date 2026-10-19) since August 29, 2026 by actors tracked as Armory Castle, UNC5221, and Warp Panda, leading to initial access, root privilege escalation, and deployment of Sawfly web shell and Bareclaw tunneler malware. No public exploit code/PoC is currently on record, consistent with targeted, actor-driven exploitation rather than commodity scanning. EPSS score is not representative here given confirmed active exploitation overriding the predictive model.