CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026, which confirms that attackers are actively exploiting a critical authentication bypass in BeyondTrust Remote Support that allows file operations on the appliance.
What Is It
CVE-2026-102764 is an authentication bypass by spoofing (CWE-290) in internal components of BeyondTrust Remote Support. NVD says these components "did not adequately validate the origin of the messages" they received. Under the right conditions, an attacker can use this to perform file operations on the appliance.
NVD published the CVE on October 15, 2026. CISA catalogs it as "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability."
Why It Matters
- Confirmed active exploitation: CISA's KEV listing confirms in-the-wild exploitation. CISA's SSVC assessment rates exploitation as "active," automatable as "yes," and technical impact as "total."
- Critical severity: NVD scores it CVSS 3.1 9.8 (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). BeyondTrust, the CNA, scores it CVSS 4.0 9.3. An attacker can exploit it over the network with low complexity, no privileges and no user interaction. - Forensic triage required: The KEV entry marks forensic triage as "Yes." It points to CISA's Forensics Triage Requirements alongside the patching guidance.
- Ransomware use: KEV lists known ransomware campaign use as "Unknown."
- Short deadline: CISA set a due date of October 19, 2026, three days after the KEV addition. The deadline binds agencies covered by BOD 26-04. Other organizations can treat it as a benchmark for how urgent the fix is.
What's Vulnerable
- Product: BeyondTrust Remote Support
- Affected versions: 26.2.3 and earlier, according to the CNA data and NVD CPE configuration (
cpe:2.3:a:beyondtrust:remote_support:*, versionEndIncluding 26.2.3)
Patch Status
The KEV entry's required action applies to agencies covered by BOD 26-04 (Prioritizing Security Updates Based on Risk). It does not apply to organizations in general. Covered agencies must apply mitigations according to BeyondTrust's instructions in advisory BT26-05, follow the BOD 26-04 guidance, and meet CISA's Forensics Triage Requirements.
Under the KEV entry, covered agencies must follow the BOD 26-04 cloud guidance for cloud deployments. If mitigations are unavailable, they must stop using the product. They must also evaluate each asset's internet exposure and follow the BOD 26-04 patching guidelines.
These steps are not mandatory for other organizations, but they are a reasonable model to follow. Any organization running an affected BeyondTrust Remote Support version should apply BT26-05 promptly, given the confirmed exploitation and critical severity. It should also consider forensic review of exposed appliances.
The supplied data does not name a fixed version. Check the vendor advisory and knowledge base article KB0024066 for remediation details.
Sources
- CISA KEV Catalog: CVE-2026-102764
- NVD: CVE-2026-102764
- BeyondTrust Security Advisory BT26-05 (Trust Center)
- BeyondTrust Blog: BT26-05
- BeyondTrust KB0024066 (login required)
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements