BeyondTrust patches CVE-2026-102764 in Remote Support, exploited since August

BeyondTrust fixed CVE-2026-102764 (CVSS 9.3) in Remote Support up to and including 26.2.3: an unauthenticated attacker could perform arbitrary file operations and escalate to root. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 19, 2026.

• CWE-290 flaw rated 9.3, fixed via BT26-05-RS
• Exploitation tied to UNC5221 (ARMORY CASTLE) from August 29
• Attackers deployed SAWFLY web shell and a SUID backdoor, stole bt-secrets
• CISA sets October 19, 2026 deadline for federal agencies