CVE-2026-102764
Attackers bypass authentication and perform file operations on BeyondTrust Remote Support
A flaw in BeyondTrust Remote Support's internal messaging components lets attackers bypass authentication and perform file operations on appliances. A suspected China-nexus espionage group has been actively exploiting this authentication bypass in zero-day attacks since late August. BeyondTrust has released patches, and CISA added it to its known exploited vulnerabilities catalog, meaning attackers are actively using it in the wild.
BeyondTrust Remote Support · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 16 Oct; US agencies must fix by 19 Oct
SeveritycriticalCVSS 9.3 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the official security update released by BeyondTrust for the Remote Support product immediately.
- If you cannot patch immediately, restrict network access to the appliances and monitor for suspicious file operations.
- Follow CISA's guidance, which requires US federal agencies to apply the patch by October 19.
What happened
- 16 OctBeyondTrust warns customers of zero-day attacks exploiting the authentication bypass in Remote Support and releases patches.
- 16 OctCISA adds the vulnerability to its known exploited vulnerabilities catalog, stating it is actively exploited.
- 19 OctRapid7 reports the authentication bypass vulnerability is being actively exploited in the wild.
- 19 OctCISA's deadline for US federal agencies to patch the affected BeyondTrust Remote Support appliances.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-102764 | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support | critical 9.3 | 16 Oct | 19% |
Our reporting
16 OctBeyondTrust warns of zero-day attacks on Remote Support appliances, patches critical flawReported elsewhere
Rapid7 · 19 OctCVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild ↗CISA · 16 OctCISA Adds Two Known Exploited Vulnerabilities to Catalog ↗CISA · 16 OctCISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support ↗The records
CISA known-exploited catalog ↗CVE-2026-102764 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works