Key Facts
- CVE: CVE-2026-102764
- CVSS: 9.3 Critical (CVSS 4.0)
- Exploited in the wild: Yes, reported by the vendor and CISA KEV (added October 16, 2026)
- Fix available: Yes
- Last updated: October 16, 2026
What Is CVE-2026-102764?
CVE-2026-102764 is an Arbitrary File Upload vulnerability in BeyondTrust Remote Support that allows an external, unauthenticated attacker to perform arbitrary file operations by issuing specially crafted requests. Internal messaging components fail to confirm that incoming messages originate from a legitimate source, allowing a remote attacker to plant files that the appliance would otherwise reject.
BeyondTrust publicly disclosed the vulnerability on October 15, 2026, and has released security patches (BT26-05) for affected Remote Support and Privileged Remote Access appliances. However, as documented by both BeyondTrust and Mandiant, this vulnerability was initially exploited in targeted intrusions prior to patches being available.
Organizations should prioritize applying patches to Remote Support and Privileged Remote Access instances where appropriate, and investigating internet-facing appliances for any evidence or indicators of prior compromise.
| CVE | Description | CVSS | Exploited in the wild |
|---|---|---|---|
| CVE-2026-102764 | Arbitrary File Upload in BeyondTrust Remote Support | 9.3 Critical (CVSS 4.0) | Yes |
Is CVE-2026-102764 Being Exploited?
CVE-2026-102764 is being exploited in the wild, as reported by the vendor and CISA, which added it to its Known Exploited Vulnerabilities catalog on October 16, 2026.
What Is BeyondTrust Remote Support?
BeyondTrust Remote Support, formerly known as Bomgar, is a remote access tool that enables IT support teams to connect and troubleshoot computers remotely.
Which BeyondTrust Remote Support Versions Are Affected?
| Product | Affected Versions | Fixed Version |
|---|---|---|
| BeyondTrust Remote Support | All versions <= 26.2.3 | Instances that have applied the BT26-05-RS Patch |
Is Your BeyondTrust Remote Support Affected?
- An attacker needs network access to the BeyondTrust Remote Support appliance to exploit the vulnerability.
How to Fix CVE-2026-102764
Security teams should apply BeyondTrust’s released security patch to all Remote Support and Privileged Remote Access appliances where possible, and investigate internet-facing instances for Indicators of Compromise and/or prior exploitation.
- Preserve appliance logs, configuration files, and system images before taking any remediation action.
- Review access, syslog, messages, thin-scc, brain, and SSL log files for signs of unauthorized file uploads or unfamiliar processes.
- Apply BeyondTrust’s security patches to every Remote Support appliance as soon as possible.
- Rotate credentials and secrets stored in the appliance’s credential vault after patching.
- Restrict network access to Remote Support appliances to trusted administrators only.
- Check startup scripts and sudoers configuration templates for entries that administrators did not add.
The vendor advisory has full details and any later changes.
How watchTowr Is Helping Clients
The watchTowr Platform delivers Preemptive Exposure Management, identifying, validating, and mitigating external exposure across enterprise environments.
- Adversary Sight engine identified BeyondTrust Remote Support instances across client environments and assessed exposure.
- Rapid Reaction identified exposure to this vulnerability across the watchTowr client base, giving teams the time they need to act.
Request a demo to see how Rapid Reaction identifies exposure to emerging threats like CVE-2026-102764.
Updates
- October 16, 2026: CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog.
