BeyondTrust Remote Support
CVE-2026-102764: authentication bypass by spoofing in BeyondTrust Remote Support.
Internal components of BeyondTrust Remote Support did not validate the origin of the messages they received, and under the right conditions an attacker can perform file operations on the appliance. CISA lists it as exploited.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 16 Oct 2026
- Federal due date 19 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 19% in 30 days
- Percentile 97%, scored 29 Oct 2026
- 9.3Critical, (CVSS 4.0)Scored by NVD
- 19%EPSS, chance of exploitation in 30 daysPercentile 97%; scored 29 Oct 2026
- 15 OctPublished by NVD15 Oct 2026; record read 17 Oct 2026
Versions
Affected and fixed.
.
What to do now
Patch the appliance and review it for access that predates the fix. The October list and its order sit in our digest.
How to check exposure
the BeyondTrust bulletin BT26-05, referenced from the NVD record, names the fixed releases for the on-premises appliance; hosted instances are patched by the vendor. The appliance's administrative interface shows its version. NVD holds a product entry and no version configuration for this flaw, so the vendor bulletin is the version check.
The exposure is the appliance's public interface, which exists to let technicians reach remote machines from the internet.
Who this reaches in Australia
Remote support tools give a help desk a session on a user's machine, which is why they appear in the catalogue so often: one appliance holds sessions into every machine it supports. Australian managed service providers and internal IT teams run Remote Support to serve staff who are rarely in an office.
Under the Essential Eight the fix is patch applications for an internet-facing service within 48 hours, and restrict administrative privileges is the strategy that limits what a session through the appliance can do on the endpoint.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : NVD record last modified
- : CISA due date for US federal agencies
Questions, answered.
Is CVE-2026-102764 exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities Catalog on 16 October 2026 with a 19 October due date for US federal agencies.
Which versions are affected?
NVD holds no version configuration for this record. the BeyondTrust bulletin BT26-05 names the on-premises releases and their fixes; hosted instances were patched by the vendor.
What does file operations on the appliance mean?
The NVD description says the components did not adequately validate message origin and an attacker could perform file operations on the appliance, which CISA classifies as an authentication bypass by spoofing.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-102764NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-102764EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, Exploited in October 2026: Ivanti, Windows, PAN-OS, Cisco and Ahsay lead 26 additions