Summary
- NHS England issued high-severity alert CC-4870 on 16 October for CVE-2026-102764.
- The flaw affects Remote Support 26.2.3 and earlier; BeyondTrust has issued a patch and already patched its SaaS service.
- Observed exploitation does not establish that NHS organisations have been compromised.
NHS England has issued a high-severity warning about active exploitation of CVE-2026-102764, a critical vulnerability affecting BeyondTrust Remote Support appliances. The flaw could permit an unauthenticated remote attacker to upload arbitrary files to a vulnerable system, creating a serious risk for organisations that expose privileged support services to external networks.
The alert, numbered CC-4870 and published on 16 October, cites security researchers who have observed exploitation involving custom malware and web shells. NHS England’s National Cyber Security Operations Centre assesses further exploitation as highly likely. That assessment describes the wider threat landscape; it does not say that an NHS organisation has suffered a confirmed compromise through this flaw.
BeyondTrust’s BT26-05 advisory explains that an internal Remote Support messaging component did not adequately validate the origin of received messages. Under relevant conditions, an attacker could perform file operations on an affected appliance. The vendor assigns CVE-2026-102764 a CVSS version 4 score of 9.3 and lists Remote Support versions up to and including 26.2.3 as affected.
A remote-support appliance can provide a highly privileged route into an organisation because it mediates support sessions, troubleshooting, and access to managed systems. An attacker controlling the appliance may be able to interfere with the trust placed in that service. The ability to upload a file is not identical to an independently demonstrated compromise of every connected endpoint, and the extent of follow-on access depends on how the appliance is deployed and what privileges it holds.
Hosted and self-hosted services have different patch paths
BeyondTrust says it applied the correcting patch to all Remote Support software-as-a-service customers by 9 October. Self-hosted customers must check whether automatic updates applied the fix and install the BT26-05 patch where required. The vendor notes that installations older than version 24.3.1 must first be upgraded before the patch can be applied. Those details are important when assessing actual exposure rather than simply counting installations of the product.
The NHS alert says BeyondTrust has also advised that Privileged Remote Access products may be affected. BeyondTrust identifies Remote Support as the affected product in BT26-05; its separate guidance says Privileged Remote Access shares affected code and recommends a precautionary patch, without establishing an equivalent demonstrated exploitation path in that product. The version scope of Remote Support must not be transferred automatically to Privileged Remote Access.
Researcher-observed exploitation means patch status must be considered alongside evidence of earlier appliance activity. Systems may be vulnerable before administrators become aware of the issue, and installing a fix does not by itself determine whether earlier unauthorised activity occurred. Organisations investigating potentially affected appliances need to distinguish remediation of the software weakness from assessment of log, file, account, and session activity during the exposure period.
Healthcare environments have additional dependencies on supplier access. Remote maintenance may be needed for clinical applications and operational systems, yet the same access path can connect external support providers to sensitive services. Disabling an appliance without understanding those dependencies can interrupt support, while leaving a vulnerable appliance connected can expose the environment to further intrusion. The manufacturer’s guidance is therefore relevant to both security and service continuity.
The vendor’s SaaS remediation date is especially relevant when interpreting exposure figures. A company using BeyondTrust’s hosted Remote Support does not necessarily have the same patch responsibility as an organisation that runs its own appliance. The latter needs to establish whether it receives automatic updates and whether the installed release can take the patch directly. Counting both groups as equally unpatched would distort the assessment. The NHS alert also calls for examination of affected products, rather than assuming a patch alone closes a possible earlier intrusion.
The confirmed facts are a critical vendor flaw, an available remediation route, and researcher-observed exploitation. NHS England has advised organisations to follow BeyondTrust’s guidance and prioritise patching affected edge systems. It has not identified a particular NHS victim in the public alert.
