Frequently Asked Questions About the BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)

What it is

CVE-2026-102764 is an arbitrary file upload in BeyondTrust Remote Support (formerly Bomgar). Internal appliance components did not check where incoming messages came from. Under conditions the vendor does not detail, an attacker could perform file operations on the appliance, including uploading files. Mandiant found it exploited as a zero-day in late August 2026. BeyondTrust disclosed it on 15 October 2026, and CISA added it to KEV on 16 October 2026.

How it works

In the intrusion Mandiant investigated, the attacker used uploaded files to install a hidden web shell that took commands through normal web traffic. The attacker then escalated to root on the host, harvested credentials stored on the appliance, and set up persistence that survived reboots. Because the appliance holds privileged access to many connected endpoints, a compromise can expose all of them.

Preconditions / Affected

The page gives no version numbers or fixed build. It says only that the flaw sits in internal components that process network messages, and that exploitation needs those components to receive attacker-controlled messages "under certain conditions".

What to do

The page lists these steps, with preservation first:

1. Preserve appliance logs and system images before changing anything, because patching can overwrite evidence.
2. Apply the patch BeyondTrust released, and read BeyondTrust's own advisory for the fixed versions.
3. Review internal appliance logs for a planted web shell or unauthorized files.
4. Rotate credentials stored in or managed through the appliance, since its credential vault is exposed.
5. Restrict network access to the management interfaces where possible.

To check for compromise:

• Look for unfamiliar files in the appliance's web directories.
• Look for new administrative accounts.
• Look for startup scripts that do not match normal configuration.
• Check the internal log files, where investigators found exploitation evidence.

Caveats

• No workaround is described for organizations that cannot patch immediately.
• BeyondTrust stores the logs on an encrypted partition, so reading them may need vendor help.
• The page names no indicators of compromise, file paths, log signatures or detection queries.
• Persistence is described only as surviving reboots, so the cleanup scope is unclear.
• The page says ransomware gangs and APT groups have historically exploited vulnerabilities like this one, but it attributes no actor to this campaign.