BeyondTrust Remote Support Zero-Day CVE-2026-102764 Hit in August, Now on CISA KEV

BeyondTrust disclosed CVE-2026-102764, a critical Remote Support flaw that lets remote attackers perform arbitrary file operations on affected appliances when internal messaging components fail to validate message origin.

BeyondTrust Remote Support versions through 26.2.3 are affected. BeyondTrust rates the issue 9.3 under CVSS 4.0 (CWE-290, authentication bypass by spoofing). NHS England's alert describes successful exploitation as allowing an unauthenticated attacker to upload arbitrary files. BeyondTrust is the scoring source; CVE.org lists the same 9.3 v4.0 score.

The zero-day was exploited on August 29, 2026. BeyondTrust says a suspected China-nexus actor hit one hosted Remote Support instance and one self-hosted appliance. The company detected the hosted compromise on September 28 during proactive hunting and contained it within 27 minutes. It reproduced the vector, applied patches to all SaaS instances by October 9, and published the public advisory (BT26-05) on October 15. BeyondTrust, with moderate to high confidence, and Mandiant attribute the activity to ARMORY CASTLE (formerly UNC5221).

Self-hosted customers must apply the BT26-05-RS patch. Versions 24.3.1 through 26.2.3 take the update via the appliance interface; older builds need an upgrade first. SaaS customers need no action. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16 with a remediation deadline of October 19. Canada's Cyber Centre and NHS England also issued alerts the same day.

Privileged Remote Access got a precautionary patch. BeyondTrust says it has not confirmed a practical exploit path in PRA but released a patch because PRA shares the affected code, and it reports no adversary activity since August.