BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)

What it is

CVE-2026-102764 is an unauthenticated arbitrary file upload flaw (CVSS 3.1 score 9.8) in BeyondTrust Remote Support, formerly Bomgar, and Privileged Remote Access. BeyondTrust disclosed it on 15 October 2026 and released patch BT26-05. CISA added it to its Known Exploited Vulnerabilities catalog on 16 October 2026.

How it works

Internal messaging components do not confirm that incoming messages come from a legitimate source. An attacker with network access to the appliance can send crafted requests that plant files the appliance would normally reject. The page gives no further technical detail.

Preconditions / Affected

The only stated precondition is network access to the appliance. No authentication is needed. The page's affected-versions section is empty, so check the BeyondTrust advisory for the version boundary.

BeyondTrust and Mandiant both document that the flaw was exploited in targeted intrusions before the patch existed. A patched appliance may therefore already have been compromised.

What to do

The page gives an order of operations:

1. Preserve appliance logs, configuration files and system images before any remediation.
2. Review these logs for unauthorized file uploads or unfamiliar processes: access, syslog, messages, thin-scc, brain and SSL.
3. Check startup scripts and sudoers configuration templates for entries administrators did not add.
4. Apply BT26-05 to every Remote Support and Privileged Remote Access appliance.
5. After patching, rotate the credentials and secrets stored in the appliance's credential vault.
6. Restrict network access to the appliances to trusted administrators only.

Imaging before patching matters because the patch and cleanup can destroy evidence of an earlier intrusion. Rotating vault secrets only after patching suggests the page treats them as exposed if the appliance was compromised.

Caveats

The page gives no indicators of compromise, file paths, hashes or detection queries. It tells readers to consult the vendor advisory for full details and later changes. The page's only update entry is the CISA KEV addition on 16 October 2026. The rest of the page describes watchTowr's commercial exposure-detection product.