CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

According to The Hacker News, CVE-2026-102764 has a CVSS score of 9.3 and is a case of improper origin validation in an internal messaging component[2]. CISA says it affects BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier[3].BeyondTrust's advisory says that as of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers[4]. The company also says customers on a Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply this patch.[4]SOCRadar reports that, according to BeyondTrust, the flaw was exploited as a zero-day on August 29, 2026, against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance.[5]SOC Prime reports that Google Threat Intelligence Group and Mandiant attribute the observed exploitation to ARMORY CASTLE, formerly tracked as UNC5221[6]. According to Mandiant, the attackers used newly identified custom malware, the SAWFLY webshell and the BARECLAW tunneler[7].BeyondTrust warned that "once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched"[2]. SOCRadar says that as of October 15, widespread exploitation of CVE-2026-102764 had not been confirmed.[5]The Hacker News reports that CISA added the flaw to its KEV catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by October 19, 2026.[2] BleepingComputer reports that Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online[1].