BeyondTrust patches Remote Support CVE-2026-102764

The advisory is the patch line

BeyondTrust advisory BT26-05, issued October 15, 2026, and updated the same day, covers CVE-2026-102764 in Remote Support. The score it prints is 9.3 on CVSS 4.0. The synopsis is improper origin validation in an internal messaging component. The impact sentence is that a remote attacker could perform file operations on an affected appliance. Affected versions are all Remote Support releases through 26.2.3. The fix for 24.3.1 through 26.2.3 is the BT26-05-RS patch. SaaS customers were patched as of October 9. Self-hosted customers on older than 24.3.1 must upgrade before the patch applies. An advisory, as the thing a reader can act on, is the standing briefthe advisory is the story.

What the company says about the actor

BeyondTrust's blog the same day says a suspected China-nexus espionage actor exploited the vulnerability as a zero-day, and that Mandiant is publishing an analysis alongside the advisory. The Record's October 16 account says BeyondTrust, Mandiant, and Google Threat Intelligence Group confirmed the exploitation, and that the company was first tipped on September 27 about activity that had begun in late August. Targets the company has named, as The Record reports them, include legal services, software providers, business-process outsourcers, technology firms, and government. This page names that scope and stops. It does not describe tools or steps. The security desk isSecurity.

A second product, patched out of caution

The blog says Privileged Remote Access shares the affected code. BeyondTrust says internal testing has not identified a way to exploit the flaw in that product, and that it shipped a patch anyway. Self-hosted Privileged Remote Access customers are told to apply it. Remote Support is the product the advisory says was vulnerable. The precautionary patch is a different sentence from a confirmed exploit. A different appliance advisory, for a different vendor, isthe Ivanti advisory.

Who still has work

SaaS customers of Remote Support, BeyondTrust says, were patched automatically and have no further action on the appliance itself. Self-hosted customers who do not take automatic updates still have to apply BT26-05-RS, or upgrade until they are on a version that can take it. The Record says Mandiant's guidance is that any internet-reachable appliance that was vulnerable should be treated as potentially compromised until it has been reviewed. That is the population this brief is willing to name. The paper isFutureweb.

What this page leaves in the advisory

The advisory tells self-hosted customers to apply the patch from the appliance interface if automatic updates are off. This brief does not repeat a click path and does not list log lines, file names, or detection rules. Those details are for the vendor's note and for a defender's own review. A catalog of exploited vulnerabilities, as a deadline rather than this product, is Asked directly, Who does BeyondTrust say was exploiting it? A suspected China-nexus espionage actor. The company's blog says the exploitation was a zero-day and that Mandiant is publishing its own analysis. The Record reports the same confirmation from BeyondTrust, Mandiant, and Google's threat group.the October 14 KEV note.

What Google has said about the pattern

The Record reports that Google said similar broad exploitation has followed past public disclosures of this kind of appliance, and that the same pattern is possible after this one. That is an expectation about what other actors may do once a patch is public. It is not a finding that every Remote Support box has been reached. The privacy desk is Asked directly, What does the advisory say an attacker could do? Perform file operations on an affected appliance, because internal components did not adequately validate the origin of messages they received. That is the impact the advisory states. This page does not add a procedure.Privacy.

How to read the date gap

The Record says exploitation was underway by late August, that a warning reached the company on September 27, and that the patch shipped in early October, with SaaS finished by October 9 and the public advisory on October 15. A zero-day, in that sequence, means the exploitation preceded the patch. The advisory date is when customers could read the CVE. It is not the first day the activity existed. The software desk isSoftware.

Who is not in scope

A reader who does not run Remote Support or Privileged Remote Access is not the audience of BT26-05. Cloud customers whose vendor already patched the appliance are, on BeyondTrust's sentence, done with the appliance step. Self-hosted internet-facing copies are the group the review warning is about. The hardware desk is Asked directly, Which product and versions does the advisory name? Remote Support, all versions through 26.2.3. The fix named for 24.3.1 through 26.2.3 is the BT26-05-RS patch. The advisory scores it 9.3 on CVSS 4.0 and lists CVE-2026-102764.Hardware.

The line to keep

CVE-2026-102764, advisory BT26-05, Remote Support through 26.2.3, SaaS patched by October 9, self-hosted copies still need the vendor patch. Exploitation before the patch is the company's account. The steps stay in the advisory, not here. The short answer this page will stand on is this: SaaS instances were patched by October 9, 2026, and need no further appliance action from the customer. Self-hosted Remote Support from 24.3.1 through 26.2.3 needs the BT26-05-RS patch. Older self-hosted versions need an upgrade before that patch applies. BeyondTrust says the flaw was exploited before the patch existed.