BeyondTrust patches Remote Support authentication bypass exploited since August to gain root on appliances

BeyondTrust patched CVE-2026-102764, a critical authentication bypass in Remote Support and Privileged Remote Access that lets an unprivileged remote attacker perform file operations on unpatched appliances, after which Mandiant observed attackers enabling SUID permissions to escalate to root. Google Threat Intelligence Group and Mandiant spotted the initial attacks, which date to late August. BeyondTrust patched SaaS customers on October 8, while self-hosted appliances must be updated manually unless automatic updates are enabled, per advisory BT26-05. Shadowserver tracks more than 1,400 exposed instances, and any internet-reachable appliance left vulnerable during the exploitation window should be treated as potentially compromised.

Check

Confirm self-hosted BeyondTrust Remote Support and Privileged Remote Access appliances are patched per advisory BT26-05, and review any internet-reachable instance exposed during the exploitation window.

Affected

Unpatched BeyondTrust Remote Support and Privileged Remote Access appliances let an unprivileged remote attacker perform file operations and escalate to root through SUID permissions.

Fix

Patch self-hosted appliances now, treat previously exposed instances as potentially compromised and investigate, rotate credentials, and restrict appliance exposure to the internet.