BeyondTrust: patch the broker, investigate its prior authority

A remote-support appliance is not merely another edge service. It can store or broker privileged credentials, maintain access routes to managed endpoints and authorise support sessions. That makes a compromise of the appliance a question about the authority it exercised, not only the version it runs today.

BeyondTrust disclosed CVE-2026-102764 on 15 October 2026. Its advisory describes inadequate origin validation in an internal messaging component of Remote Support that can allow a remote attacker to perform file operations on an affected appliance. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 16 October. The advisory defines the vulnerability; it does not, by itself, establish how many installations were compromised or what happened in each one.

What is known about exploitation

BeyondTrust says an actor exploited a zero-day on 29 August against one vendor-hosted Remote Support instance and one self-hosted appliance. At its 16 October update, those were the two impacted customers it knew of, with no additional activity observed since August. That is a bounded vendor observation, not a global victim count or assurance that other unexamined deployments are clean.

In the self-hosted intrusion Mandiant investigated, it observed a web shell, escalation to root-level control, attempts to access the appliance's credential vault, deletion of local logs and changes to support permissions. The actor then used a support session and native file-transfer capability to reach an internal endpoint and obtain files. These are case-specific observations after exploitation, not automatic consequences of the CVE on every affected appliance.

The patch decision depends on deployment

BeyondTrust lists Remote Support versions up to and including 26.2.3 as affected. It says the remediation patch had been applied to all Remote Support SaaS customers by 9 October. Self-hosted customers running 24.3.1 through 26.2.3 should verify whether the BT26-05-RS patch was applied, including via automatic updates. Older self-hosted versions must first upgrade to a supported version before applying that patch. An inventory entry or a planned update is not proof of the running appliance's patch state.

Privileged Remote Access shares affected code and BeyondTrust recommends a precautionary patch for self-hosted PRA. The vendor says its testing had not identified an exploitation path in PRA. That distinction should survive into exposure reports: Remote Support is confirmed vulnerable; PRA patching is precautionary on the evidence available here.

The investigation is a different decision

Because the known intrusions preceded disclosure and patching, a current patched state cannot establish whether an appliance was used before the fix. Mandiant observed local log deletion in its investigation. Teams assessing a suspected compromise therefore need off-appliance syslog, support-session and file-transfer records, identity and permission changes, and perimeter evidence for the exposure window. If compromise is indicated, the scope can extend to brokered credentials and endpoints reached through support sessions.

This is an incident-response implication drawn from the reported sequence, not a claim that every exposed installation was breached. Preserve evidence before disruptive isolation or rebuilding, and follow the vendor and investigator guidance appropriate to the deployment. Where remote support is used for an industrial site, any interruption to support access needs an authorised continuity decision; the inspected sources do not report a physical process consequence in these cases.

Related CUP analyses separate a technical fix from retrospective assurance in other products. AhsayCBS patch correction. FortiMail remediation and investigation. These cases do not share the same vulnerability mechanism or evidence of exploitation.

Next review event. Update this analysis if BeyondTrust changes the remediation path, confirms additional affected deployments, or Mandiant publishes materially different exploitation evidence. Do not convert a forecast of wider exploitation into an observed campaign.