Number: AL26-025
Date: October 16, 2026
Audience
This Alert is intended for IT professionals and managers.
Purpose
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
Details
The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting BeyondTrust Remote Support (RS)Footnote 1Footnote 2. In response to the vendor advisory released on October 15, 2026, the Cyber Centre released AV26-1054 on October 16, 2026Footnote 3.
Tracked as CVE-2026-102764Footnote 4, this vulnerability is an Authentication Bypass by Spoofing vulnerability (CWE-290)Footnote 5 that affects all versions of BeyondTrust Remote Support.
Successful exploitation of this vulnerability may allow a remote, unauthenticated attacker to exploit insufficient origin validation in internal BeyondTrust Remote Support messaging components to perform unauthorized file operations on an affected appliance without user interaction. The vulnerability requires no credentials or user action and can enable arbitrary file uploads, potentially resulting in full compromise of the appliance.
The Cyber Centre has observed open-source reporting indicating that the vulnerability is being exploited in the wildFootnote 6.
Suggested actions
The Cyber Centre strongly recommends that organizations running affected BeyondTrust Remote Support deployments upgrade to the following fixed version:
| Affected product | Affected versions | Fixed versions |
|---|---|---|
| BeyondTrust Remote Support | Versions 26.2.3 and prior | BT26-05-RS patch for versions 24.3.1 to v26.2.3 |
BeyondTrust has confirmed that a patch addressing this vulnerability was applied to all Remote Support SaaS and Privileged Remote Access SaaS customers as of 9 October 2026. Organizations using these SaaS offerings do not need to take any additional action to remediate this issue.
The Cyber Centre also recommends organizations to:
- identify BeyondTrust Remote Support deployments within their environments and determine whether they are SaaS-hosted or self-hosted
- verify the installed Remote Support version. Systems running 26.2.3 or earlier are identified as affected by BeyondTrust
- upgrade Remote Support installations older than 24.3.1 to a newer supported version before applying the remediation patch
- apply the BT26-05-RS patch to affected self-hosted Remote Support deployments running versions 24.3.1 through 26.2.3
- confirm automatic updates are enabled, where appropriate. BeyondTrust specifically advises manual patching for self-hosted instances that are not subscribed to automatic updates
- as an additional defensive measure, review affected appliances for unexpected or unauthorized file activity, particularly when an appliance was exposed while vulnerable
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security ActionsFootnote 7 with an emphasis on the following topics:
- consolidating, monitoring, and defending Internet gateways
- patch operating systems and applications
- harden operating systems and applications
- isolate web-facing applications
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.