MDR
Solutions
Partners
About
Resources
Affected Environment
BeyondTrust Remote Support versions 26.2.3 and earlier, including BeyondTrust-hosted and self-hosted appliances.
Threat Overview
CVE-2026-102764 (CVSS 9.3) is a critical origin validation flaw allowing remote attackers to perform unauthorised file operations.
Exposure Timeline
Exploitation confirmed 29 August 2026; report issued 15 October 2026; BT26-05-RS patch covers versions 24.3.1 to 26.2.3.
Attack Surface
Internal messaging component of Remote Support appliances, whether hosted by BeyondTrust or self-hosted.
Technical Root Cause
Internal components do not adequately validate the origin of the messages they receive.
Exploitation Pathway
Remote attacker abuses unvalidated messages to run file operations, deploy a web shell, and gain administrative control.
Operational Impact
Web shell deployment, administrative control, persistence across reboots, stored credential access, and deletion of logs and attack tooling.
Strategic Impact
Compromised remote support appliances give attackers trusted access to customer environments. Attributed to ARMORY CASTLE (UNC5221, WARP PANDA).
Required Mitigation
Apply the BeyondTrust BT26-05-RS patch immediately after testing; segment appliances and enforce least privilege.
Incident Response Guidance
Hunt for web shells, review appliance logs for file operations, rotate stored credentials, and treat missing logs as suspicious.
References
BeyondTrust advisory BT26-05, BeyondTrust blog, CVE.org, NCSC Ireland, NVD.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)