CVE-2026-102764 is an actively exploited authentication bypass in BeyondTrust Remote Support, the enterprise platform formerly known as Bomgar that help desks and IT service teams use to reach users’ computers, transfer files and conduct attended or unattended support sessions. It is deployed either as BeyondTrust-hosted SaaS or, importantly here, as a customer-operated physical or virtual B Series Appliance—the central point through which remote-support connections pass.
The flaw matters because an internet-reachable support appliance can be both an entry point and a place that holds powerful connections: managed endpoints, support-session records, audit data and, in some configurations, credential-vault capabilities. Remote Support is common in organisations with formal support operations, including government, education, healthcare, finance, manufacturing, critical infrastructure providers and managed-service providers.
A spoofed internal message crosses the trust boundary
BeyondTrust classifies CVE-2026-102764 as CWE-290, authentication bypass by spoofing. Internal Remote Support components did not adequately check where received messages came from. An unauthenticated remote attacker can, under the conditions the vendor describes only generally, make those components accept a message as though it came from a trusted origin and perform file operations on the appliance.
That is not merely a user-level support-session issue. The vulnerable trust decision sits inside the appliance. BeyondTrust is deliberately withholding the technical details while self-hosted customers patch, so the exact message format, validation logic and file-operation paths are not public. There is no published vendor code diff or vulnerable code pattern to inspect.
Exploitation reached appliances before disclosure
This is not a hypothetical exposure. BeyondTrust confirmed zero-day exploitation on August 29 against one hosted Remote Support instance and one self-hosted appliance; as of its October 16 update, it knew of those two affected customers and had not observed further adversary activity after August. CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalogue on October 16; the official CVE record marks exploitation as active.
Mandiant links the activity to suspected China-nexus espionage actor ARMORY CASTLE, formerly UNC5221. Its campaign account describes uploaded files, a PHP webshell, attempted credential extraction, persistence and use of compromised Remote Support administrator credentials to reach downstream systems. Those observed actions show why appliance file access is dangerous; they do not establish that every exploitation of this flaw automatically delivers the same level of access.
No usable public proof of concept or exploit code could be confirmed as of October 17. A repository presented as a PoC has no referenced exploit.py and directs visitors to request private access, so its claimed capabilities are not publicly demonstrated.
Patch self-hosted appliances without waiting
All Remote Support versions through 26.2.3 are affected. Apply BeyondTrust’s BT26-05-RS patch immediately on supported versions 24.3.1 through 26.2.3. Systems older than 24.3.1 must upgrade to a supported release first, then install the patch; administrators should also verify whether automatic appliance updates already applied it. BeyondTrust says SaaS customers were patched by October 9, while its timeline says automatic patching began October 8; it does not explicitly reconcile release with completion.
Privileged Remote Access shares relevant code and received a precautionary patch, but BeyondTrust says testing has not found a way to exploit CVE-2026-102764 against it. Treat exposed self-hosted Remote Support as an urgent containment and patching task, then review appliance logs, files, administrator accounts and downstream sessions for August-era activity. SecAlerts can monitor an organisation’s actual software stack and alert on new vulnerabilities affecting the products it runs.
