BeyondTrust Remote Support Authentication Bypass and Arbitrary File Operation Advisory (CVE-2026-102764)

• Immediate Patching: Access the BeyondTrust Service-Now portal and apply the updates referenced in KB0024066 without delay.
• Access Control: Ensure that the appliance is not directly reachable from the public internet. Implement Zero Trust Network Access (ZTNA) or VPN for administrative tasks.
• Log Auditing: Review appliance logs for suspicious file system activity or unexpected internal communication patterns that may indicate exploitation attempts.

# Remediation Checklist
- [ ] Verify current firmware version
- [ ] Apply BeyondTrust KB0024066 Patch
- [ ] Restrict Management Port (e.g., 443) to Trusted IPs only
- [ ] Monitor for unauthorized file modifications in /var/lib/ or configuration directories

CVE-2026-102764 is a critical authentication bypass vulnerability (CWE-290) residing in the internal components of BeyondTrust Remote Support. The flaw stems from inadequate validation of the origin of messages received by these components. An attacker can exploit this by sending specially crafted messages to perform unauthorized file operations on the appliance. Given its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog and an EPSS score of 0.94, this vulnerability is a primary target for threat actors. Unauthorized file access often serves as a precursor to arbitrary code execution and persistent backdoor installation.