AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764
BeyondTrust Remote Support CVE-2026-102764 is being exploited for unauthenticated file upload and full appliance compromise.
Canada's Cyber Centre alert AL26-025 warns of CVE-2026-102764, a critical authentication-bypass-by-spoofing flaw (CWE-290) in all versions of BeyondTrust Remote Support. A remote unauthenticated attacker can abuse weak origin checks in internal messaging to upload arbitrary files and fully compromise an appliance, with no credentials or user interaction. Open-source reporting indicates exploitation in the wild. SaaS Remote Support and Privileged Remote Access were patched on 9 October 2026; self-hosted versions 24.3.1 through 26.2.3 need the BT26-05-RS patch, and older installs must upgrade first.
- CVE-2026-102764 is an unauthenticated authentication-bypass-by-spoofing flaw in all Remote Support versions.
- Exploitation can enable arbitrary file uploads and full appliance compromise without user interaction.
- Cyber Centre cites open-source reporting of in-the-wild exploitation.
- SaaS customers were patched as of 9 October 2026; self-hosted systems need BT26-05-RS.
- Versions through 26.2.3 are affected; installs older than 24.3.1 must upgrade before the patch.
Vulnerabilities mentionedAll →
- CVE-2026-1027649.3<1%Message-origin spoofing enables file ops on BeyondTrust Remote Supportpublished · BeyondTrust Remote Support KEV PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article496 words · extracted from cyber.gc.ca · click to collapse
Number: AL26-025
Date: October 16, 2026
Audience
This Alert is intended for IT professionals and managers.
Purpose
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
Details
The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting BeyondTrust Remote Support (RS)Footnote 1Footnote 2. In response to the vendor advisory released on October 15, 2026, the Cyber Centre released AV26-1054 on October 16, 2026Footnote 3.
Tracked as CVE-2026-102764Footnote 4, this vulnerability is an Authentication Bypass by Spoofing vulnerability (CWE-290)Footnote 5 that affects all versions of BeyondTrust Remote Support.
Successful exploitation of this vulnerability may allow a remote, unauthenticated attacker to exploit insufficient origin validation in internal BeyondTrust Remote Support messaging components to perform unauthorized file operations on an affected appliance without user interaction. The vulnerability requires no credentials or user action and can enable arbitrary file uploads, potentially resulting in full compromise of the appliance.
The Cyber Centre has observed open-source reporting indicating that the vulnerability is being exploited in the wildFootnote 6.
Suggested actions
The Cyber Centre strongly recommends that organizations running affected BeyondTrust Remote Support deployments upgrade to the following fixed version:
| Affected product | Affected versions | Fixed versions |
|---|---|---|
| BeyondTrust Remote Support | Versions 26.2.3 and prior | BT26-05-RS patch for versions 24.3.1 to v26.2.3 |
BeyondTrust has confirmed that a patch addressing this vulnerability was applied to all Remote Support SaaS and Privileged Remote Access SaaS customers as of 9 October 2026. Organizations using these SaaS offerings do not need to take any additional action to remediate this issue.
The Cyber Centre also recommends organizations to:
- identify BeyondTrust Remote Support deployments within their environments and determine whether they are SaaS-hosted or self-hosted
- verify the installed Remote Support version. Systems running 26.2.3 or earlier are identified as affected by BeyondTrust
- upgrade Remote Support installations older than 24.3.1 to a newer supported version before applying the remediation patch
- apply the BT26-05-RS patch to affected self-hosted Remote Support deployments running versions 24.3.1 through 26.2.3
- confirm automatic updates are enabled, where appropriate. BeyondTrust specifically advises manual patching for self-hosted instances that are not subscribed to automatic updates
- as an additional defensive measure, review affected appliances for unexpected or unauthorized file activity, particularly when an appliance was exposed while vulnerable
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security ActionsFootnote 7 with an emphasis on the following topics:
- consolidating, monitoring, and defending Internet gateways
- patch operating systems and applications
- harden operating systems and applications
- isolate web-facing applications
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.