BeyondTrust Remote Support: Improper origin validation allows file operations

Summary

An unauthenticated remote attacker can abuse internal messaging components of BeyondTrust Remote Support that do not properly validate message origin, allowing file operations on the appliance. CISA lists the flaw as known exploited, and an actor linked to China-nexus espionage has used it against at least one system. Self-hosted instances reachable from the internet are the main risk, because a compromise can expose stored and brokered credentials.

Affected

• Remote Support self-hosted, versions 0 to 26.2.3 (per BeyondTrust advisory BT26-05)
• SaaS instances: patched by the vendor as of October 9, 2026, no customer action needed for the vendor-hosted service
• Privileged Remote Access shares some affected code; BeyondTrust reports no exploitation path but issued a precautionary patch

Fixed in

• Patch BT26-05-RS for self-hosted versions 24.3.1 through 26.2.3
• Versions older than 24.3.1 must first be upgraded to a newer version; no patch is available for these builds per research, so consult the vendor advisory for the target version
• Source of truth: BeyondTrust advisory BT26-05

Workaround

• No vendor-documented workaround; patching is the only named fix
• CISA interim guidance: limit external access to the appliance to the services needed by users and customers, and restrict administrative interfaces to trusted networks

Exploitation

• Exploited in the wild: yes (CISA KEV, added 2026-10-16)
• Exploitation reportedly began on August 29, 2026; Google Threat Intelligence/Mandiant attributes it to ARMORY CASTLE (formerly UNC5221), a suspected China-nexus group
• Reported post-exploitation activity includes file staging, theft of internal documents and access to stored credentials
• Public proof of concept: unknown

Our recommendation

• Identify all Remote Support instances and whether each is SaaS or self-hosted; confirm the version
• Apply BT26-05-RS on self-hosted systems; upgrade builds older than 24.3.1 first
• Remove or restrict internet exposure of the appliance and its admin interface
• Hunt for compromise from August 29, 2026 onward: review logs, admin changes (Jump Item and Team permissions) and new file artifacts
• After patching, rotate all credentials stored or injected by the appliance, revoke active support sessions and review new MFA registrations on privileged accounts
• Patching does not remove a prior compromise

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (3 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Worthes/CVE-2026-102764-Proof-of-concept · maxprog-svg/CVE-2026-102764 · CompleteTech-Security/beyondtrust-remote-support-cve-2026-102764-check

Research sources

• BeyondTrust Security Advisory BT26-05 www.beyondtrust.com
• BeyondTrust Blog BT26-05 www.beyondtrust.com
• NVD CVE-2026-102764 nvd.nist.gov
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• CISA Alert: Urges patching of BeyondTrust Remote Support www.cisa.gov
• Canadian Centre for Cyber Security AL26-025 www.cyber.gc.ca
• Google Threat Intelligence: ARMORY CASTLE exploits BeyondTrust cloud.google.com
• GitHub Advisory GHSA-pf95-v8m2-73q8 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:28.