CERT-In Warns of Critical BeyondTrust Remote Support Authentication Bypass

India's Computer Emergency Response Team (CERT-In) has issued a critical vulnerability notice for BeyondTrust Remote Support, warning that a security flaw could allow remote attackers to perform unauthorised file operations on affected systems.

Published on October 23, 2026, vulnerability note CIVN-2026-0518 identifies the issue as an authentication bypass vulnerability affecting BeyondTrust Remote Support versions 26.2.3 and earlier. The vulnerability is tracked as CVE-2026-102764.

The issue arises from inadequate validation of the origin of messages received by an internal component of the software. Successful exploitation could allow an attacker to carry out file operations on a targeted appliance, potentially affecting system confidentiality and integrity.

CERT-In has advised affected organisations to apply the appropriate vendor updates.

What Is the BeyondTrust Remote Support Vulnerability?

BeyondTrust Remote Support is a remote support solution that enables IT teams to access systems remotely and provide technical assistance to users.

Organisations use remote support tools to troubleshoot technical problems, maintain systems and assist users without requiring physical access to their devices.

Because these tools facilitate remote interactions with systems, weaknesses in their authentication or message-handling mechanisms can create security risks.

According to BeyondTrust's official security advisory, the vulnerability exists in internal components that did not adequately validate the origin of incoming messages. Under the right conditions, this weakness could be exploited to perform file operations on an affected appliance.

The vulnerability is classified as critical by both CERT-In and BeyondTrust.

Key Details at a Glance

CVSS score of 9.3 is reported in BeyondTrust's official advisory. CERT-In classifies the vulnerability as critical in its published note.

How Does the Vulnerability Work?

Authentication and message validation help software determine whether incoming requests or communications should be trusted.

In this case, BeyondTrust reports that an internal messaging component did not adequately validate the origin of messages it received. This could create an opportunity for a remote attacker to trigger unauthorised file operations under the conditions required for exploitation.

The confirmed potential impact is unauthorised file operations on an affected appliance. The vendor's published advisory does not establish that every affected deployment is exploitable in the same way.

Which Versions Are Affected?

CERT-In identifies BeyondTrust Remote Support versions 26.2.3 and earlier as affected.

BeyondTrust's official advisory confirms that all Remote Support versions up to and including 26.2.3 are impacted.

The vendor lists the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Customers running versions older than 24.3.1 must upgrade to a newer version before applying the relevant patch.

Organisations should identify the exact Remote Support version running in their environment and consult the official vendor instructions before making changes.

What Should Organisations Do?

Organisations using BeyondTrust Remote Support should prioritise checking their deployments and applying the appropriate security update.

Recommended actions include:

1. Identify affected deployments

Inventory all BeyondTrust Remote Support appliances and record their installed versions. Include self-hosted deployments and any other instances managed by separate IT teams.

2. Apply the vendor's security patch

Follow BeyondTrust's official BT26-05 advisory to determine the correct patch or upgrade path for each installation.

3. Check automatic update status

BeyondTrust states that its Remote Support SaaS customers had the remediation patch applied by October 9, 2026. Self-hosted customers should verify whether their instances received the patch automatically. If not, they should apply it manually as directed by the vendor.

4. Confirm remediation

After updating, verify the installed version or patch status against the vendor's instructions. Keep records of affected instances and completed remediation.

5. Review suspicious activity where appropriate

As a precaution, security teams can review relevant system and administrative logs for unusual file operations or unexpected activity around the affected appliances. This is a general defensive recommendation, not a claim that exploitation has been confirmed in a particular organisation.

Has BeyondTrust Released a Fix?

Yes. BeyondTrust's official advisory, BT26-05, states that the company has remediated the vulnerability.

According to the advisory, the remediation patch was applied to all Remote Support SaaS customers as of October 9, 2026. Self-hosted customers whose instances are not subscribed to automatic updates must apply the patch manually.

For supported versions from 24.3.1 through 26.2.3, BeyondTrust lists the BT26-05-RS patch. Customers running versions older than 24.3.1 need to upgrade to a newer version to apply the fix.

Organisations should use the official vendor advisory to confirm the correct remediation path for their specific deployment.

Why This Matters for IT and Security Teams

Remote support platforms are part of the operational infrastructure used to maintain business systems and resolve technical issues. A vulnerability that may allow unauthorised file operations deserves prompt attention because it can affect the integrity and confidentiality of the system.

For security teams, this incident reinforces the importance of maintaining an accurate software inventory, monitoring vendor security advisories and verifying that patches reach every relevant deployment.

For managed service providers and IT administrators, the response may require coordination across multiple customer environments or internally managed appliances. Tracking patch status helps teams avoid leaving older installations unaddressed.

These are broader operational implications of the disclosed vulnerability, rather than evidence of confirmed exploitation across affected organisations.

Conclusion

CERT-In's warning highlights a critical authentication bypass vulnerability in BeyondTrust Remote Support that could permit unauthorised file operations on affected appliances.

The affected range includes versions 26.2.3 and earlier, and BeyondTrust has published remediation guidance under advisory BT26-05. Organisations should identify their deployments, verify patch status and follow the vendor's recommended update path.

For administrators, the priority is to ensure that every affected installation is accounted for and that remediation is verified rather than assumed.