Full Report
BeyondTrust security advisory (AV26-1054)
Analysis Summary
# Vulnerability: BeyondTrust Remote Support Vulnerability (CVE-2026-102764, Advisory AV26-1054)
## CVE Details
- CVE ID: CVE-2026-102764
- CVSS Score: Not provided in the source
- CWE: Not provided in the source
## Affected Systems
- Products: BeyondTrust Remote Support
- Versions: Prior to or equal to 26.2.3
- Configurations: Not specified in the source
## Vulnerability Description
The source does not describe the technical nature of the flaw. It states only that, as of October 15, 2026, BeyondTrust Remote Support is affected by a vulnerability. The advisory points to a BeyondTrust blog post about "ARMORY CASTLE and BT26-05" for further details, which should be reviewed directly.
## Exploitation
- Status: Exploited in the wild (per open-source reporting cited by the Canadian Cyber Centre)
- Complexity: Not specified in the source
- Attack Vector: Not specified in the source
## Impact
- Confidentiality: Not specified in the source
- Integrity: Not specified in the source
- Availability: Not specified in the source
## Remediation
### Patches
- Upgrade Remote Support to a version later than 26.2.3. The source does not name a specific fixed version, so confirm the exact build in BeyondTrust's advisory.
### Workarounds
- None listed in the source. Check the BeyondTrust blog post for vendor-recommended mitigations.
## Detection
- Indicators of compromise: None provided in the source.
- Detection methods and tools: None provided in the source. Review BeyondTrust's guidance and your own logs for unexpected remote support sessions, unfamiliar administrative activity, and access from unknown sources.
## References
- Canadian Cyber Centre advisory: hxxps://cyber[.]gc[.]ca/fr/alertes-avis/bulletin-securite-beyondtrust-av26-1054
- BeyondTrust blog, ARMORY CASTLE and BT26-05: hxxps://www[.]beyondtrust[.]com/blog/entry/bt26-05
- BeyondTrust Security Advisories: hxxps://www[.]beyondtrust[.]com/trust-center/security-advisories
**Priority note:** Because the vulnerability is reported as actively exploited, treat this as urgent. The source is thin on technical detail, so the BeyondTrust blog post and security advisories page are the primary sources for the CVSS score, CWE, fixed version, and indicators of compromise.