BeyondTrust CVE-2026-102764: Patch and Hunt

Self-hosted BeyondTrust Remote Support customers should verify the BT26-05-RS patch and investigate prior exposure to CVE-2026-102764. Mandiant reports zero-day exploitation in late August 2026 and recommends reviewing internet-reachable, vulnerable appliances as potentially compromised (Mandiant analysis). Preserve evidence, rebuild when warranted, and rotate exposed credentials only after the appliance is patched or rebuilt.

BeyondTrust disclosed this Common Vulnerabilities and Exposures (CVE) identifier on October 15, 2026; its advisory affects Remote Support (RS) versions through 26.2.3 (BeyondTrust advisory BT26-05). Mandiant’s accompanying investigation attributes observed exploitation to ARMORY CASTLE, a suspected China-linked espionage actor formerly tracked as UNC5221 (Mandiant analysis). The new development is the disclosure and response guidance, not a claim that attacks began this week.

What are the key takeaways?

• Self-hosted RS versions 24.3.1 through 26.2.3 need BT26-05-RS; older versions require an upgrade before patching (BeyondTrust advisory BT26-05).
• BeyondTrust says all RS software-as-a-service (SaaS) customers were patched by October 9, 2026 (BeyondTrust advisory BT26-05).
• Mandiant observed persistence and log deletion, so patch status alone does not settle prior compromise (Mandiant analysis).
• Mandiant recommends rotating credentials after patching or rebuilding, not while an attacker may still control the appliance (Mandiant analysis).

What does the vulnerability allow?

BeyondTrust describes improper validation of message origins in an internal Remote Support component, allowing a remote attacker to perform file operations on an affected appliance (BeyondTrust advisory BT26-05). Mandiant reports arbitrary file upload followed by privilege escalation and persistent access in the investigated intrusion (Mandiant analysis).

The investigation identified the SAWFLY webshell and BARECLAW tunneler, along with credential harvesting and deletion of appliance logs (Mandiant analysis). These observations support a review beyond the appliance’s current software version; they do not establish that every customer was compromised.

BeyondTrust also issued a precautionary patch for Privileged Remote Access (PRA), which shares the affected code. The vendor says its testing had not identified an exploitation path in PRA (BeyondTrust response guidance). Do not describe observed RS attacks as confirmed PRA exploitation.

Which deployments need action now?

Identify whether the deployment is vendor-hosted or self-hosted, then verify the relevant patch status. BeyondTrust’s advisory separates the customer actions as follows (BeyondTrust advisory BT26-05).

Mandiant says SaaS customers do not need to patch the appliance themselves, but its credential and configuration review guidance still applies (Mandiant analysis). Distinguish vendor-managed remediation from your organization’s review of accounts, support sessions, and possible downstream access.

Our managed patch management service can support update verification. Do not close an incident solely because the patch is now present.

What should the response team do this week?

Run remediation and exposure assessment together, with preservation planned before destructive recovery. Mandiant recommends a patch-first approach and separate containment and rebuild measures for compromised or suspected appliances (Mandiant analysis).

1. Record exposure and patch status. Identify internet reachability during the vulnerable period, the installed release, patch evidence, and the accountable owner. Mandiant says a vulnerable appliance reachable during the exploitation window should be treated as potentially compromised until reviewed (Mandiant analysis).
2. Preserve evidence where compromise is suspected. Mandiant calls for virtual-appliance snapshots with memory and disk export before changes or reboot; hardware and SaaS customers should request forensic preservation through BeyondTrust Support (Mandiant analysis).
3. Coordinate containment. Mandiant recommends perimeter isolation, restricted outbound access, and termination of support access paths for suspected or compromised appliances. These measures interrupt support operations, so coordinate with help-desk and vendor-support owners (Mandiant analysis).
4. Rebuild when required. Mandiant recommends a clean, fully patched image for confirmed or unknown compromise status because host-level persistence can survive reboot and configuration reset (Mandiant analysis).
5. Remediate identities and review downstream access. After patching or rebuilding, follow the research guidance for credential rotation, session invalidation, configuration review, and investigation of endpoints accessed through support sessions (Mandiant analysis).

For related evidence planning, see the Ivanti appliance-response article. Its product-specific recovery instructions do not apply to BeyondTrust.

Which records should investigators prioritize?

Preserve off-appliance logs alongside available appliance and session evidence. BeyondTrust recommends forwarding syslog and session events because an attacker may delete local records (BeyondTrust response guidance).

Mandiant recommends collecting perimeter firewall and reverse-proxy records for the exposure window, reviewing account and permission changes, and examining support-session reports and file transfers (Mandiant analysis). Our recommendation is to reconcile suspicious activity against approved support work and retain the evidence supporting each conclusion.

A quiet log is not a clean bill of health. Document missing records and unresolved exposure rather than treating absent alerts as proof that the appliance was untouched.

How would our SOC handle this response?

Our U.S.-based security operations center (SOC) would track patch verification, forensic preservation, and identity remediation as distinct workstreams. We would coordinate with appliance and support owners before actions that interrupt remote assistance.

We would document evidence gaps and assign owners to credential and downstream endpoint reviews. This is our proposed approach, not a customer incident; use the managed SOC pricing guide to clarify monitoring and response responsibilities.

What else should administrators know?

Was CVE-2026-102764 exploited before disclosure?

Yes. Mandiant reports zero-day exploitation in late August 2026, before BeyondTrust’s October 15 disclosure (Mandiant analysis).

Are Remote Support SaaS customers already patched?

BeyondTrust says all RS SaaS customers were patched by October 9. Mandiant separately recommends credential and configuration review (BeyondTrust advisory BT26-05) (Mandiant analysis).

Should we rotate credentials before rebuilding?

Mandiant says to rotate only after the appliance is patched or rebuilt, because earlier rotation could expose replacement credentials to an attacker still controlling it (Mandiant analysis).

Is rebooting enough for a compromised appliance?

No. Mandiant reports persistence that survives reboot and configuration reset, and recommends clean-image redeployment for confirmed or unknown compromise status (Mandiant analysis).

Need help verifying remediation?

Bring your appliance inventory, update plan, and response questions to a focused review. Schedule a security review or Call 833-92-CYBER to clarify remediation and investigation responsibilities.