https://reddit.com/r/sysadmin/comments/1x8ughc/beyondtrust_rs_zeroday_cve2026102764_patched_but/: BeyondTrust RS zero-day (CVE-2026-102764): patched, but what's everyone doing about possible earlier access?

Q: Which deployments are affected?

Self-hosted BeyondTrust Remote Support deployments through version 26.2.3 are affected. The SaaS service was patched on 9 October.

Q: Is there evidence of exploitation before a fix was available?

Yes. CISA added CVE-2026-102764 to its exploited-vulnerabilities list, and Mandiant and Google's threat intelligence group reported exploitation beginning on 29 August.

Q: How far back should incident review go?

Review Remote Support session logs back to at least late August, because reported exploitation began on 29 August. The reported pre-fix exploitation period was about six weeks.

Q: What checks are identified for systems that may have been exposed?

In addition to applying the patch, check for unknown PHP files, rotate credentials the appliance could access, and review historical session logs. Also audit which remote-support and administrative consoles are externally exposed.

Published Oct 18, 2026

Updated

Affected Software

1 affected component

BeyondTrust Remote Support<=26.2.3

Frequently Asked Questions

Which deployments are affected?

Self-hosted BeyondTrust Remote Support deployments through version 26.2.3 are affected. The SaaS service was patched on 9 October.

Is there evidence of exploitation before a fix was available?

Yes. CISA added CVE-2026-102764 to its exploited-vulnerabilities list, and Mandiant and Google's threat intelligence group reported exploitation beginning on 29 August.

How far back should incident review go?

Review Remote Support session logs back to at least late August, because reported exploitation began on 29 August. The reported pre-fix exploitation period was about six weeks.

What checks are identified for systems that may have been exposed?

In addition to applying the patch, check for unknown PHP files, rotate credentials the appliance could access, and review historical session logs. Also audit which remote-support and administrative consoles are externally exposed.

https://reddit.com/r/sysadmin/comments/1x8ughc/beyondtrust_rs_zeroday_cve2026102764_patched_but/: BeyondTrust RS zero-day (CVE-2026-102764): patched, but what's everyone doing about possible earlier access?

Affected Software

Frequently Asked Questions

Which deployments are affected?

Is there evidence of exploitation before a fix was available?

How far back should incident review go?

What checks are identified for systems that may have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Is there evidence of exploitation before a fix was available?

How far back should incident review go?

What checks are identified for systems that may have been exposed?