Full Report
AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764
Analysis Summary
# Vulnerability: BeyondTrust Remote Support Authentication Bypass by Spoofing (CVE-2026-102764)
## CVE Details
- **CVE ID:** CVE-2026-102764
- **CVSS Score:** Not provided in the source article
- **CWE:** CWE-290 (Authentication Bypass by Spoofing)
## Affected Systems
- **Products:** BeyondTrust Remote Support (RS)
- **Versions:** All versions. The vendor-based fixed-version table lists 26.2.3 and prior as affected.
- **Configurations:**
- Self-hosted deployments are affected. The fix is the BT26-05-RS patch for versions 24.3.1 through 26.2.3.
- Self-hosted installations older than 24.3.1 must first be upgraded to a newer supported version before applying the patch.
- Remote Support SaaS and Privileged Remote Access SaaS customers were patched as of October 9, 2026, and need no further action.
- Automatic updates may cover some self-hosted instances. BeyondTrust advises manual patching for self-hosted instances not subscribed to automatic updates.
## Vulnerability Description
The flaw is an authentication bypass caused by insufficient origin validation in internal BeyondTrust Remote Support messaging components. A remote, unauthenticated attacker can abuse this to perform unauthorized file operations on an affected appliance. No credentials or user interaction are required. The attacker can upload arbitrary files, which may lead to full compromise of the appliance.
## Exploitation
- **Status:** Exploited in the wild. The Cyber Centre observed open-source reporting of active exploitation, linked to the ARMORY CASTLE activity described by Google Cloud Threat Intelligence.
- **PoC Availability:** Not stated in the source article.
- **Complexity:** Not explicitly rated. Based on the stated requirements (no credentials, no user action), exploitation appears low complexity. This is an inference.
- **Attack Vector:** Network (remote, unauthenticated)
## Impact
- **Confidentiality:** Not explicitly rated. Unauthorized file operations on the appliance suggest potential exposure of data. (Inferred)
- **Integrity:** High. Arbitrary file upload may allow full compromise of the appliance. (Inferred from "full compromise")
- **Availability:** Not explicitly rated. Full appliance compromise could affect service availability. (Inferred)
## Remediation
### Patches
- **BT26-05-RS** for self-hosted Remote Support versions 24.3.1 through 26.2.3
- Upgrade self-hosted versions older than 24.3.1 to a newer supported version before applying BT26-05-RS
- SaaS customers (Remote Support SaaS and Privileged Remote Access SaaS): already patched as of October 9, 2026
### Workarounds
The source article does not list temporary mitigations beyond patching. The Cyber Centre's recommended defensive measures are:
- Identify all BeyondTrust Remote Support deployments and determine whether each is SaaS-hosted or self-hosted.
- Verify installed versions. Systems running 26.2.3 or earlier are affected.
- Confirm automatic updates are enabled where appropriate.
- Isolate web-facing applications and consolidate and monitor Internet gateways.
## Detection
- **Indicators of compromise:** The source article does not provide specific IOCs (file names, hashes, IP addresses, or log patterns).
- **Detection methods:**
- Review affected appliances for unexpected or unauthorized file activity, especially any appliance that was exposed while vulnerable.
- Check the installed Remote Support version against the affected range.
- Refer to the ARMORY CASTLE threat intelligence reporting (see References) for additional technical detail.
- **Reporting:** Report suspected activity via My Cyber Portal (hxxps[://]www[.]cyber[.]gc[.]ca[/]en[/]incident-management) or email contact[@]cyber[.]gc[.]ca.
## References
- BeyondTrust Security Advisory BT26-05: hxxps[://]www[.]beyondtrust[.]com[/]trust-center[/]security-advisories[/]bt26-05
- BeyondTrust blog, "ARMORY CASTLE and BT26-05: What Security Teams Need to Know": hxxps[://]www[.]beyondtrust[.]com[/]blog[/]entry[/]bt26-05
- Canadian Centre for Cyber Security advisory AV26-1054: hxxps[://]www[.]cyber[.]gc[.]ca[/]en[/]alerts-advisories[/]beyondtrust-security-advisory-av26-1054
- CVE Record: hxxps[://]www[.]cve[.]org[/]CVERecord?id=CVE-2026-102764
- CWE-290: hxxps[://]cwe[.]mitre[.]org[/]data[/]definitions[/]290[.]html
- Google Cloud Threat Intelligence, "ARMORY CASTLE Exploits BeyondTrust": hxxps[://]cloud[.]google[.]com[/]blog[/]topics[/]threat-intelligence[/]armory-castle-exploits-beyondtrust
- Canadian Centre for Cyber Security Top 10 IT Security Actions (ITSM.10.089): hxxps[://]www[.]cyber[.]gc[.]ca[/]en[/]guidance[/]top-10-it-security-actions-protect-internet-connected-networks-and-information-itsm10089