CVE-2026-102764: BeyondTrust Remote Support Auth Bypass Exploited in the Wild — Detection and Remediation Guide

On October 15, 2026, BeyondTrust disclosed a critical authentication bypass vulnerability in BeyondTrust Remote Support (RS), tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3. The flaw allows an unauthenticated, remote attacker to perform file operations on an affected appliance with no user interaction required. This is the exact class of vulnerability — pre-auth, remotely reachable, file-system level access on an internet-facing remote administration platform — that experienced IR teams treat as a five-alarm fire.

What elevates this from a routine critical patch to an active incident is the exploitation timeline. BeyondTrust's October 16 follow-up report confirms in-the-wild exploitation occurred prior to disclosure, with two known compromises dating to August 29, 2026: one BeyondTrust-hosted instance and one self-hosted appliance. BeyondTrust discovered and contained the hosted compromise on September 28 — meaning attackers had roughly a month of dwell time in that environment. If you operate a self-hosted RS appliance, you must assume that threat actors possessed working exploit capability for at least six weeks before public disclosure, and your appliance may have been exposed the entire time.

Remote Support is not a peripheral tool. It is the privileged access layer your helpdesk and sysadmins use to troubleshoot and administer endpoints across the enterprise. A compromised RS appliance is a beachhead with a direct line into every managed endpoint in your estate. Patch first, then hunt.

Technical Analysis

Affected Products and Versions

Note the nuance here: BeyondTrust patched its own hosted infrastructure (and discovered a compromise in the process), but self-hosted appliances are your responsibility. If you are running 26.2.3 or earlier without BT26-05-RS applied, you are exposed right now.

How the Vulnerability Works — Defender's View

CVE-2026-102764 is an authentication bypass in the RS platform. From a defensive standpoint, the key characteristics are:

• Pre-authentication: The attacker never needs valid credentials, a session cookie, or a stolen token. Any network path to the appliance's web interface is a viable attack path.
• No user interaction: There is no phishing or social engineering component to disrupt. Exposure equals exploitability.
• File operations on the appliance: Unauthenticated file read/write/execute-class operations on a hardened remote administration platform translate directly into configuration tampering, credential and session-token theft, arbitrary file upload (i.e., webshell or tooling deployment), and — critically — the ability to hijack or inject into legitimate remote support sessions targeting managed endpoints.

The observed attack chain in the August 29 compromises, consistent with what we've seen in prior remote-access platform intrusions, follows a predictable arc:

1. Reconnaissance and exploitation against the internet-facing RS web interface (TCP/443).
2. Unauthenticated file operations to stage tooling or modify appliance components.
3. Persistence and internal access — leveraging the appliance's trusted position to reach managed endpoints or harvest session material.
4. Dwell time — the hosted compromise ran from August 29 to September 28 before containment. Self-hosted victims without dedicated appliance monitoring may never have detected anything at all.

Exploitation Status

• Confirmed active exploitation in the wild — at least two compromises (one hosted, one self-hosted), both dated August 29, 2026, per BeyondTrust's October 16 report.
• Exploitation predates public disclosure by approximately six weeks, so treat this as a burned zero-day window: retrospective compromise assessment is mandatory, not optional.
• Given the CVSS 9.3, pre-auth nature, and public confirmation of exploitation, expect rapid weaponization by additional actors post-disclosure. Check CISA KEV daily; vulnerabilities of this profile on remote administration platforms are near-certain KEV additions.

Detection & Response

Self-hosted RS appliances are hardened Linux-based systems, and their weakest telemetry point is usually the appliance itself — most organizations never forward appliance syslog or web access logs to their SIEM. Fix that today; it is a prerequisite for everything below. The detections here target the observable behaviors of post-exploitation on and around the appliance: anomalous process execution under the web-service context, unexpected file writes in web-accessible paths, and rare outbound connections from a device that should only talk to a small, known set of destinations.

Sigma Rules

---
title: BeyondTrust RS Appliance - Suspicious Child Process of Web Service
description: Detects shell interpreters, download tools, or script engines spawned by the BeyondTrust Remote Support web service context, consistent with post-exploitation of an authentication bypass such as CVE-2026-102764.
author: Security Arsenal
date: 2026/10/17
status: experimental
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/java'
      - '/bomgar-scc'
  selection_img:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
      - '/chmod'
      - '/chown'
  condition: selection_parent and selection_img
falsepositives:
  - Rare; legitimate RS upgrade or vendor support scripts may invoke shells — correlate with approved maintenance windows and BeyondTrust support tickets
level: critical
---
title: Webshell or Dropped File Creation in BeyondTrust RS Web Paths
description: Detects creation of script or executable files in web-accessible directories on a BeyondTrust RS appliance, a common follow-on action after unauthenticated file-write exploitation (CVE-2026-102764).
author: Security Arsenal
date: 2026/10/17
status: experimental
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/'
      - '/www/'
      - '/appliance/'
      - '/bomgar/'
      - '/tmp/'
      - '/dev/shm/'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.php'
      - '.sh'
      - '.py'
      - '.elf'
  filter_legit:
    User|contains:
      - 'packagekit'
      - 'rpm'
  condition: selection_path and selection_ext and not filter_legit
falsepositives:
  - Official BeyondTrust patch deployments (BT26-05-RS) will write files to appliance paths — baseline during your approved patching window, then alert on everything else
level: high
---
title: BeyondTrust RS Appliance - Outbound Connection to Rare Destination
description: Detects outbound network connections from the RS appliance to ports or destinations outside its expected baseline (vendor update infrastructure and managed endpoints), indicative of C2 or exfiltration following appliance compromise.
author: Security Arsenal
date: 2026/10/17
status: experimental
logsource:
  category: network_connection
detection:
  selection_src:
    SourceHostname|contains:
      - 'btrs'
      - 'bomgar'
      - 'remotesupport'
  filter_beyondtrust:
    DestinationHostname|contains:
      - '.beyondtrust.io'
      - '.bomgar.com'
      - '.beyondtrustcloud.com'
  condition: selection_src and not filter_beyondtrust
falsepositives:
  - Managed endpoint session traffic from your own internal ranges — scope SourceHostname to your appliance naming convention and allowlist documented BeyondTrust infrastructure for your region
level: medium

KQL — Microsoft Sentinel Hunt

This query assumes your RS appliance forwards syslog and web access logs to Sentinel (Syslog/CEF ingestion) and that egress traffic from the appliance's VLAN passes a monitored firewall. The first hunt looks for unauthenticated access anomalies in web logs; the second looks for rare egress from the appliance over the pre-disclosure exposure window.

// Hunt 1: Unauthenticated requests to RS appliance admin/api paths that returned success
// Tune $ApplianceIP to your self-hosted RS appliance address(es)
let ApplianceIP = "10.0.0.50";
let Lookback = 60d; // Cover the pre-disclosure exposure window back to late August
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DestinationIP == ApplianceIP
| where RequestURL has_any ("/api/", "/admin", "/login", "/console", "/download", "/files")
| where ApplicationProtocol == "GET" or ApplicationProtocol == "POST"
| where ReceivedBytes > 0
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    URIs = make_set(RequestURL, 20), ResultCodes = make_set(DeviceCustomString1, 10)
  by SourceIP
| where RequestCount > 0
| extend GeoNote = "Pivot on SourceIP in threat intel and geo enrichment - flag any source outside expected admin/helpdesk ranges"
| project SourceIP, RequestCount, FirstSeen, LastSeen, URIs, ResultCodes
| order by FirstSeen asc;
// Hunt 2: Rare outbound destinations from the RS appliance (C2/exfil after compromise)
let ApplianceIP2 = "10.0.0.50";
CommonSecurityLog
| where TimeGenerated > ago(60d)
| where SourceIP == ApplianceIP2
| where DeviceAction !in ("Deny", "deny", "Drop")
| summarize ConnCount = count(), FirstSeen = min(TimeGenerated), Ports = make_set(DestinationPort, 15)
  by DestinationIP, DestinationHostName
| where ConnCount < 50 // rare destinations only
| extend Suspicion = iff(DestinationPort in (dynamic([4444, 5555, 6666, 8080, 8443, 9001, 1337])), "HIGH - uncommon egress port", "Review")
| order by FirstSeen asc

Velociraptor VQL — Appliance / Endpoint Forensic Hunt

Deploy this artifact against any Linux system co-located with or adjacent to the appliance (jump hosts, management servers) and, where you have shell-level access to the self-hosted appliance during IR, adapt paths accordingly. It hunts for dropped scripts/binaries in volatile directories and suspicious processes running under web-service accounts.

-- Hunt for dropped payloads in volatile directories and processes running under web-service accounts
-- Context: CVE-2026-102764 post-exploitation artifacts on BeyondTrust RS appliance or adjacent hosts

-- Part 1: Recently created scripts/executables in volatile or web paths
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/tmp/**/*', '/dev/shm/*', '/var/tmp/*', '/var/www/**/*.jsp', '/var/www/**/*.sh', '/var/www/**/*.py'])
WHERE Ctime > timestamp(epoch='2026-08-25')
  AND Mode =~ 'x'
ORDER BY Ctime

-- Part 2: Processes executing under web-service or unprivileged accounts with shells/tools
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Username =~ 'www-data|apache|nginx|nobody|bomgar'
  AND (Exe =~ '/(bash|sh|dash|python|python3|perl|curl|wget|nc|ncat)$'
       OR CommandLine =~ 'base64|/dev/tcp|curl|wget|chmod \+x')

Remediation & Verification Script

Run this against your self-hosted appliance management context and adjacent infrastructure. It inventories exposure, verifies the patch state you should confirm in the BeyondTrust admin UI, and checks adjacent Linux systems for the artifact classes described above.

#!/bin/bash
# CVE-2026-102764 - BeyondTrust RS exposure check & adjacent-host artifact sweep
# Run on adjacent Linux management/jump hosts; verify appliance patch level via the RS admin interface (/appliance)

set -euo pipefail
REPORT="cve-2026-102764-check-$(date +%Y%m%d).txt"

echo "=== CVE-2026-102764 Verification - $(date) ===" | tee "$REPORT"

# 1. Confirm appliance version & patch: MANUAL STEP
#    Log into https://<rs-appliance>/appliance > Status / Updates
#    REQUIRED: RS 26.2.3 or earlier MUST have patch BT26-05-RS applied.
#    If BT26-05-RS is not listed as applied, treat the appliance as EXPOSED and COMPROMISE-ASSESS it.
echo "[ACTION REQUIRED] Verify BT26-05-RS is applied in the RS admin UI." | tee -a "$REPORT"

# 2. Check whether the appliance is internet-reachable from this vantage point
RS_HOST="rs.example.com"   # <-- set to your appliance FQDN
echo "--- External reachability check for $RS_HOST ---" | tee -a "$REPORT"
if timeout 5 bash -c "</dev/tcp/$RS_HOST/443" 2>/dev/null; then
  echo "[WARNING] TCP/443 reachable. Confirm this is intentional and patch is applied." | tee -a "$REPORT"
else
  echo "[INFO] TCP/443 not reachable from this host." | tee -a "$REPORT"
fi

# 3. Sweep for dropped executables/scripts in volatile paths created since Aug 25, 2026
echo "--- Volatile-path artifacts since 2026-08-25 ---" | tee -a "$REPORT"
find /tmp /dev/shm /var/tmp -type f \( -perm -u+x -o -name '*.sh' -o -name '*.py' -o -name '*.elf' \) \
  -newermt "2026-08-25" -printf '%T+ %p\n' 2>/dev/null | sort | tee -a "$REPORT"

# 4. Web-service accounts running shells or transfer tools (post-exploitation signature)
echo "--- Web-context process anomalies ---" | tee -a "$REPORT"
ps -eo user,pid,ppid,comm,args | grep -Ei 'www-data|apache|nginx|nobody|bomgar' | \
  grep -Ei 'bash|sh$|python|perl|curl|wget|nc |ncat|base64' | grep -v grep | tee -a "$REPORT" || echo "[OK] None found." | tee -a "$REPORT"

# 5. Established outbound connections to rare external destinations
echo "--- Current outbound connections ---" | tee -a "$REPORT"
ss -tnp state established 2>/dev/null | awk '{print $4, $5, $6}' | sort -u | tee -a "$REPORT"

echo "=== Done. Review $REPORT. Any hits in sections 3-5 on the appliance or adjacent hosts = open an IR case. ==="

Remediation

Take these steps in order of priority:

1. Apply patch BT26-05-RS immediately to every self-hosted Remote Support appliance running version 26.2.3 or earlier. Verify application in the /appliance administrative interface under Updates — do not rely on a change ticket alone. Reference BeyondTrust's official advisory and patch documentation at the BeyondTrust Trust Center: https://www.beyondtrust.com/trust-center and the Rapid7 analysis at the source URL for this incident.
2. Assume breach for any appliance exposed before patching. Given confirmed exploitation dating to August 29, 2026, patching alone is not closure. Conduct a retrospective compromise assessment: review web access logs back to late August, hunt with the queries above, and look for unauthenticated successful requests to administrative/API paths, dropped files, and rare egress.
3. Rotate credentials and session material. If your appliance was unpatched during the exposure window, rotate credentials stored in or transiting RS: integration accounts, stored endpoint credentials, API keys, and any local appliance admin accounts. File-operation access on the appliance means session tokens and stored secrets must be considered compromised.
4. Restrict network exposure. If the RS portal does not strictly require public internet access, place it behind a VPN or IP-allowlist perimeter. At minimum, restrict the administrative (/appliance) interface to dedicated management networks. A pre-auth file-operations bug is only exploitable from networks that can reach the listener.
5. Forward appliance telemetry to your SIEM now. Syslog, web access logs, and authentication events from the RS appliance should flow to Sentinel/your SIEM on a permanent basis. The hosted compromise had a month of dwell time; the only thing standing between you and the same outcome is telemetry you actually collect and alert on.
6. Monitor CISA KEV (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) for CVE-2026-102764. If added, federal deadlines apply to FCEB agencies, and the KEV due date is a strong proxy for the urgency private-sector organizations should apply.
7. Review downstream trust. RS can push software and initiate sessions to managed endpoints. If compromise is suspected, audit sessions initiated during the exposure window and inspect endpoints that received RS-driven sessions from anomalous technician accounts or at unusual hours.

This incident is the latest data point in a pattern every security leader should internalize: remote access and remote administration platforms — the very tools used to manage and defend the enterprise — are priority-one targets because of the privileged position they occupy. Your patch SLA for internet-facing, pre-auth-critical vulnerabilities on these platforms should be measured in hours, and your detection strategy must assume the patch will sometimes come after the attackers.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub