ContentsTap to jump to a section＋
- Remote Support 26.2.3 and earlier are affected; CVSS 4.0 severity is critical at 9.3.
- Mandiant reports exploitation in late August, disclosed on October 15.
- Self-hosted appliances need BT26-05-RS; versions older than 24.3.1 must first be upgraded.
An October 16 alert for remote-support operators
The Canadian Centre for Cyber Security issued an alert on October 16, 2026 concerning CVE-2026-102764 in BeyondTrust Remote Support. An unauthenticated remote attacker can perform unauthorized file operations without user interaction. BeyondTrust rates the flaw critical, with a CVSS 4.0 score of 9.3.
The vendor disclosed the flaw on October 15. Mandiant reports evidence of exploitation in late August during an incident-response investigation. October 18 is this article’s publication date, not the date exploitation began.
Distinguish appliance versions from patch status
BeyondTrust lists Remote Support 26.2.3 and earlier as affected. BT26-05-RS covers versions 24.3.1 through 26.2.3. Older deployments must first upgrade to a supported version before applying the patch. Recording only the main version number cannot prove remediation.
BeyondTrust says Remote Support SaaS customers were patched by October 9. Self-hosted customers without automatic updates must apply the patch manually. A statement about vendor-hosted services does not establish that a customer-managed appliance is fixed.
Why the access gateway deserves priority
Remote Support gives IT staff a path to troubleshoot users’ endpoints. Friday Works recommends prioritizing the appliance according to its exposure and entrusted privileges, and identifying its owner and the accounts it uses.
Mandiant describes persistence and evidence deletion after exploitation. Those findings do not mean every customer was compromised. Review local assets and logs against vendor guidance rather than attempting exploitation against production systems.
Track remediation and incident review separately
Friday Works recommends separate owners for patch installation and review of possible earlier misuse. Preserve proof of successful BT26-05-RS installation, test authorized support sessions and reconcile access records with approved work.
Unexpected files, unfamiliar accounts or suspicious logging gaps warrant evidence preservation and escalation to the incident-response team and vendor. Installing a patch closes the known entry point; it does not automatically undo an intruder’s previous changes.
A concrete completion record
Classify hosted and self-hosted deployments, record running versions and update settings, select the supported upgrade path, install the patch and validate legitimate operations. Managed-service customers should obtain appliance-specific, dated confirmation.
These are Friday Works’ operational recommendations, not findings from a customer assessment. Consult the October 15 vendor advisory and October 16 Canadian alert for subsequent changes. Do not extend this product-specific scope to unrelated BeyondTrust products.
References
Sources used in this guide
We prioritise official guidance and primary technical sources. Visit each source for full context and the latest updates.
- BT26-05 — published and updated 15 October 2026BeyondTrust ↗︎
- AL26-025 — published 16 October 2026Canadian Centre for Cyber Security ↗︎
- ARMORY CASTLE Exploits BeyondTrust — 15 October 2026Mandiant / Google Threat Intelligence Group ↗︎
- BeyondTrust Corporation; resized proportionally, centered with neutral margins; no crop or invented interfaceBeyondTrust Corporation ↗︎
- BeyondTrust Press & Media brand assets; editorial identification of the vendor; trademark ownership retainedBeyondTrust Corporation ↗︎