BeyondTrust Remote Support CVE-2026-102764 Hit CISA’s KEV: Patch Self-Hosted Appliances by Oct 19

If your business, or the IT company that supports you, uses BeyondTrust Remote Support to connect to your computers, today is the day to confirm it has been patched. On Thursday, October 15, BeyondTrust published security advisory BT26-05 for CVE-2026-102764, a critical flaw in Remote Support. The next day, CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a federal remediation due date of Monday, October 19. That’s today.

Here’s the short version. BeyondTrust says a suspected China-nexus espionage actor used this bug as a zero-day before anyone knew it existed. Remote support tools hold the keys to every machine they can reach. When one gets compromised, the attacker doesn’t land on a single PC. They land on the system built to reach all of them. Below is what New York City business owners and office managers need to know, using only what BeyondTrust, CISA, and NIST have published.

What CVE-2026-102764 is, in plain terms

BeyondTrust’s advisory describes the issue as “Improper Origin Validation in an Internal Messaging Component.” Some internal parts of Remote Support did not properly check where the messages they received were coming from. The vendor says that, “under the right conditions, this could be used to perform file operations on the appliance.” The NIST National Vulnerability Database entry carries the same description and classifies the weakness as CWE-290, Authentication Bypass by Spoofing.

CISA’s KEV listing calls it the “BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability” and says it “could allow a remote attacker to perform file operations on the appliance.” BeyondTrust rates it Critical, with a CVSS v4 base score of 9.3. The scoring vector says the attack works over the network, needs no login, and needs no user to click anything. It also rates the impact to confidentiality, integrity, and availability as high.

We won’t describe how the bug works, and neither will BeyondTrust. Its BT26-05 blog post says the company is “withholding the technical details of the vulnerability” while self-hosted appliances are still being patched. That’s the right call. Your job is to make sure the patch is installed.

Who is affected

• Product: BeyondTrust Remote Support (RS), all versions up to and including 26.2.3.
• Fix: the BT26-05-RS patch, available for versions 24.3.1 through 26.2.3.
• Older versions: appliances running a Remote Support version older than 24.3.1 have to upgrade to a newer version before the patch can be applied.
• SaaS (BeyondTrust-hosted) customers: BeyondTrust says the patch was applied to all Remote Support SaaS customers as of October 9, and no further action is required.
• Self-hosted customers: you have to apply the patch yourself unless the appliance is subscribed to automatic updates in its /appliance interface.
• Privileged Remote Access (PRA): BeyondTrust says its testing found no way to exploit the bug in PRA. Because PRA shares the affected code, though, the company released a patch for PRA as well and recommends self-hosted PRA customers apply it immediately.

Not sure whether you use BeyondTrust at all? That’s normal for a small business, since remote support software usually belongs to whoever does your IT. Ask them. There’s a short script below.

Why this one is urgent

CISA only adds a vulnerability to the KEV catalog when there’s evidence it’s being exploited. This entry carries a federal remediation date of October 19, three days after it was added. CISA’s required action is to apply the vendor’s mitigations, and the entry is flagged for forensic triage. In other words, CISA expects organizations to check for signs of compromise as well as patch. CISA lists known ransomware campaign use as “Unknown.”

BeyondTrust’s blog gives a timeline. The actor first exploited the zero-day on August 29, 2026 against two customers: one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. BeyondTrust’s threat hunting found the activity on September 28. The patch shipped on October 8, and public disclosure followed on October 15. As of the blog’s last update, BeyondTrust said it knew of only those two impacted customers and had seen no adversary activity since August.

So why patch today if only two customers were hit? Because of what happens after disclosure. BeyondTrust attributes the activity, with moderate to high confidence, to the group Mandiant and Google Threat Intelligence Group track as UNC5221, which Mandiant now calls ARMORY CASTLE. BeyondTrust writes that this actor uses a zero-day selectively and then, “once the vulnerability is public,” typically moves to broad exploitation of every instance still unpatched. BeyondTrust adds that Mandiant is warning defenders to expect the same here. The same post ties this group to earlier zero-day exploitation of Citrix NetScaler and Ivanti Connect Secure, the kind of edge and remote-access gear we’ve covered before, including the Citrix NetScaler SAML KEV earlier this month.

Why remote support tools are such a big target

For an NYC dental office, law firm, or property manager, remote support is how a technician fixes a printer or resets a profile without driving across the Verrazzano. That convenience depends on trust. The tool is allowed to reach your computers, and it often stores or brokers the credentials needed to log in to them.

BeyondTrust’s own write-up spells out why that matters. “A remote access appliance stores and brokers privileged credentials across an estate,” the company writes, “which makes it a credential source and a map of who connects to what.” In the incident it investigated, BeyondTrust says the actor planted a web shell, moved to full administrative control of the appliance within minutes, set up persistence designed to survive a reboot, read the appliance’s stored secrets, and then deleted logs and its own tools before leaving.

That last detail changes how you should think about evidence. If the only logs live on the appliance, they may be gone or altered. BeyondTrust says logs forwarded off the appliance, and logs from outside systems, are what investigators need.

What to do this week

BeyondTrust’s guidance comes down to five steps. Here they are in plain language for a small business.

1. Patch, or confirm the patch is already in place

If you or your provider run a self-hosted Remote Support appliance, apply the BT26-05 patch now. If the appliance is older than 24.3.1, plan the upgrade today, not next quarter. If you’re on BeyondTrust’s SaaS, the vendor says you were patched automatically, so just get written confirmation from whoever manages the account. Self-hosted PRA customers should apply the PRA patch too.

2. Shrink what’s exposed to the internet

BeyondTrust recommends exposing only the parts of a remote access appliance that users and customers actually need. Administrative interfaces should be restricted to trusted networks, and outbound traffic from management appliances should be limited to the destinations they need. If the admin login page for your remote support tool can be reached from anywhere on the internet, ask why.

3. Get the logs off the box

Forward appliance syslog and session events to a separate log system or SIEM in near real time. BeyondTrust notes that this actor deletes local logs, and off-box copies “are often the only record left.”

4. Look for suspicious behavior, not just known indicators

Because this actor changes its infrastructure and tools for every victim, BeyondTrust says to hunt for behavior. That means admin sessions you can’t tie to a known person or ticket, especially from residential or commercial VPN addresses. It also means unknown script files in web directories, unexpected changes to accounts, permissions, or session policies (including “Jump Items” or “Teams” permissions), and log forwarding that stops and restarts within a single session. BeyondTrust says Mandiant has published indicators and YARA rules, and BeyondTrust customers can request a threat hunting package through the trust portal.

5. If anything looks wrong, treat stored credentials as exposed

BeyondTrust’s advice: rotate every credential the appliance stored or injected. Watch those accounts for logins outside a managed session or from unfamiliar locations, review new multi-factor registrations on privileged accounts, and image the appliance before rebuilding it. If you believe you have evidence of exploitation, BeyondTrust asks customers to open a Sev 1 support request citing “BT26-05.”

A quick checklist for NYC business owners

• Find out what remote support tool your IT provider uses. If it’s BeyondTrust Remote Support or Privileged Remote Access, ask whether it’s SaaS or self-hosted.
• Get a written answer on patch status. Ask for the BT26-05 patch status and the date it was applied, not just “we’re on it.”
• Ask about logs. Are the appliance’s logs and session records sent somewhere the attacker couldn’t easily erase?
• Ask about credentials. Which of your passwords or admin accounts does the tool store? Is there a plan to rotate them if a compromise is confirmed?
• Review who has access. Remove old technicians, former vendors, and shared accounts from any remote access tool that touches your systems.
• Turn on multi-factor authentication for every remote access and admin account that supports it, and know who approves new MFA enrollments.
• Check your other edge gear. VPNs, firewalls, and remote access appliances are this actor’s preferred way in.

A simple script for the conversation with your IT provider

You don’t need to be technical to ask the right questions. Try something like this:

“CISA added BeyondTrust Remote Support CVE-2026-102764 to its Known Exploited Vulnerabilities list with an October 19 deadline. Do you use BeyondTrust Remote Support or Privileged Remote Access to support us? If so, is it hosted by BeyondTrust or self-hosted, when was the BT26-05 patch applied, and are the appliance’s logs sent off the box? Have you reviewed it for signs of compromise?”

A good provider will answer quickly and in writing. If the answer is vague, or if nobody knows which remote tools have access to your network, that’s a finding in itself.

What MicroSky does for clients when a KEV lands

When CISA adds a remote access or edge-device flaw to the KEV catalog, our process at MicroSky Managed Services is the same every time. We check our asset inventory to see who runs the affected product. We confirm the vendor’s fixed version or patch, apply it or verify the vendor applied it, and confirm the result. Then we review access, logs, and exposure on the device and document all of it for the client. It’s the same routine we followed for FortiMail CVE-2026-104286 and other recent KEV entries.

If you’re not sure whether BeyondTrust or any other remote support tool can reach your systems, or you want an independent check on how your current provider handled BT26-05, we can help. Call MicroSky at (718) 672-2177 or visit microskyms.com to talk with our team.

Sources: BeyondTrust Security Advisory BT26-05; BeyondTrust, “ARMORY CASTLE and BT26-05: What Security Teams Need to Know” (updated October 16, 2026); CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.16); NIST NVD, CVE-2026-102764.