Frequently Asked Questions About the BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)

What is CVE-2026-102764?

The Arbitrary File Upload in BeyondTrust Remote Support is a vulnerability in internal appliance components that did not adequately validate where incoming messages came from. Under certain conditions, this let an attacker perform file operations on the appliance, including uploading arbitrary files. BeyondTrust Remote Support is enterprise remote access software that IT teams use to connect to and troubleshoot remote endpoints, so a compromised appliance can expose every system it connects to.

In the intrusion that Mandiant investigated, the attacker used uploaded files to install a hidden web shell, a small script that let them send commands to the appliance through normal web traffic. The attacker then escalated to root-level control of the host, harvested credentials stored on the appliance, and set up persistence that survived reboots.

Is CVE-2026-102764 being exploited in the wild?

CVE-2026-102764 is being exploited in the wild, as reported by the vendor and CISA, which added it to its Known Exploited Vulnerabilities catalog on October 16, 2026.

How did CVE-2026-102764 come to light?

BeyondTrust disclosed the Arbitrary File Upload in BeyondTrust Remote Support on October 15, 2026. During an incident response engagement, Mandiant, part of Google Threat Intelligence Group, found evidence that a threat actor had exploited the vulnerability as a zeroday in late August 2026, before any patch existed.

How is watchTowr helping BeyondTrust Remote Support customers?

• Adversary Sight engine identified BeyondTrust Remote Support instances across client environments and assessed exposure.
• Rapid Reaction identified exposure to this vulnerability across the watchTowr client base, giving teams the time they need to act.

What is BeyondTrust Remote Support?

BeyondTrust Remote Support, formerly called Bomgar, is an enterprise secure remote access product. IT teams use it to connect to and troubleshoot remote endpoints across an organization, giving support staff a central appliance with privileged access to many connected systems.

Which BeyondTrust Remote Support versions are affected?

• The vulnerability affects internal appliance components that process messages reaching BeyondTrust Remote Support over the network.
• Exploitation depends on these internal components receiving attacker-controlled messages, which the vendor describes as happening under certain conditions without further detail.

How do I fix CVE-2026-102764?

BeyondTrust has released a patch for the Arbitrary File Upload in BeyondTrust Remote Support, and organizations should apply it as soon as possible. Guidance from the investigation urges immediately applying the security patches BeyondTrust provided and reviewing BeyondTrust’s own advisory. No workaround has been described for organizations that cannot patch right away.

1. Preserve appliance logs and system images before making any changes, since patching can overwrite evidence.
2. Review internal appliance logs for signs that a web shell or unauthorized files were planted.
3. Apply the patch BeyondTrust released for the Arbitrary File Upload in BeyondTrust Remote Support.
4. Rotate credentials stored in or managed through the appliance, since a compromised appliance exposes its credential vault.
5. Restrict network access to the appliance’s management interfaces wherever possible.

How do I check BeyondTrust Remote Support for compromise?

Investigators have found exploitation evidence inside the appliance’s internal log files, though BeyondTrust stores these logs on an encrypted partition that may need vendor assistance to read. Organizations should also look for unfamiliar files placed in the appliance’s web directories and for new administrative accounts or startup scripts that do not match normal configuration.

What types of threat actors typically exploit this vulnerability?

Historically, ransomware gangs and APT groups exploit these vulnerabilities.

Have there been similar BeyondTrust Remote Support vulnerabilities before?

Yes. These earlier BeyondTrust Remote Support vulnerabilities were added to the CISA KEV catalog after exploitation in the wild: