News date: 2026-10-15 · Sources reviewed: 2026-10-26

Remote support platforms are high-value infrastructure: they connect administrators, credentials and corporate endpoints. On 15 October 2026, BeyondTrust published advisory BT26-05 covering CVE-2026-102764 in Remote Support. Both BeyondTrust and Mandiant confirmed earlier zero-day exploitation, making the status of self-hosted installations an urgent security question.

Confirmed facts and timeline

BeyondTrust rates CVE-2026-102764 Critical with a CVSS v4 score of 9.3. The flaw involves improper origin validation in an internal messaging component and can permit unauthenticated remote file operations on an affected appliance under the relevant conditions. BeyondTrust describes exploitation on 29 August 2026, detection on 28 September, October remediation and public disclosure on 15 October.

Product: BeyondTrust Remote Support, formerly Bomgar.
The exploitation was observed in the wild, not merely demonstrated in a lab.
The 9.3 rating uses CVSS version 4.

Which deployments need remediation

The advisory identifies Remote Support versions up to and including 26.2.3 as affected. Self-hosted versions 24.3.1 through 26.2.3 can receive the BT26-05-RS patch; older versions require an upgrade first. BeyondTrust says Remote Support SaaS deployments had been patched by 9 October 2026. Applying the fix closes the flaw but does not prove the appliance was never compromised before patching.

Inventory version, hosting model and automatic-update status.
Verify BT26-05-RS through /appliance or vendor support.
Do not treat a reboot as sufficient to remove possible persistence.

Why an appliance compromise matters beyond the appliance

Mandiant documented malware on an affected appliance, privilege escalation and abuse of remote support capabilities. The business question is not only whether the software is currently patched; it is also whether an intruder accessed identities, managed systems or sensitive files during the exposure window. That assessment requires correlated evidence across the appliance and downstream endpoints.

Review changes to administrators, Jump Items, roles and API accounts.
Investigate unusual support sessions, file transfers and missing log intervals.
Retain firewall, reverse-proxy and centrally forwarded syslog records.

Respond without destroying evidence

Where compromise is suspected, coordinate incident response before destructive changes. Mandiant describes a patch-first approach where appropriate, but isolation and a clean rebuild may be necessary for confirmed or unresolved compromise. Rotate sensitive credentials only after the attacker’s access has been removed; otherwise replacement credentials may also be exposed.

Preserve evidence and establish the exposure window.
Patch or isolate according to risk and operational constraints.
Review configuration, rebuild from trusted images when necessary and rotate credentials in dependency order.

A sustainable remote support security baseline

Restrict administrative interfaces, enforce strong authentication and least privilege, export logs to an independent platform and keep patch verification on a defined schedule. Remote support should be governed as a privileged access system rather than treated as a routine helpdesk tool.

Phishing-resistant SSO or MFA where supported.
Administrative network restrictions and separation of duties.
Periodic access revocation and recovery exercises.

VALUE360 can assist with exposure assessment, remote-access reviews and remediation planning. Suspected compromise requires qualified incident response and coordination with the product vendor.

Explore the related VALUE360 service →

Sources

Remediation prioritization

Prioritize by actual exposure, affected software versions, privileges and signs of compromise—not headline severity alone. Confirm affected releases and mitigations against the vendor advisory.

Implementation questions

Does this automatically affect our environment?

No. First verify whether the specific product, version and relevant configuration are deployed.

Is a security tool enough on its own?

No. Combine patching, restricted access, logging and tested backups.

BeyondTrust Remote Support: CVE-2026-102764 exploited as a zero-day