BeyondTrust Remote Support, CVE-2026-102764: on CISA's exploited list

The bottom line

If you run BeyondTrust Remote Support on 26.2.3 or earlier, act today: CISA's 19 October 2026 date has already passed. First find out whether you run it and which version, because the record names no fixed version.

Free analysis report · 8 pagesBeyondTrust Remote Support, CVE-2026-102764: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

The record says internal components did not properly check where messages came from. An attacker could send spoofed messages and, under the right conditions, perform file operations on the appliance. CISA says the attacker can be remote.

Why it matters

Our reading is that an appliance which accepts spoofed messages and lets a stranger change files should be treated as exposed until shown otherwise. The record scores it 9.3 (CVSS 4.0) and lists CWE-290, authentication bypass by spoofing. It does not say whether a login is needed, so assume none until the vendor says otherwise.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It only touches files, so it is minor." The record gives 9.3 and CISA lists it as exploited. The sources do not say how far file operations can go, so do not assume the damage is small.
• "We are patched because we are on the latest version we know of." The record names no fixed version. Only the affected range, up to and including 26.2.3, is stated.

How we would triage it

This is our judgement.

Step 1: Find the versions you run

• Ask your IT provider whether Remote Support is in use and where it is hosted.
• Read the version from the appliance's admin screen and compare it with 26.2.3.

Step 2: Reduce exposure

• Restrict who can reach the appliance to known networks while no fix is confirmed.
• Ask the vendor for its mitigation instructions, as CISA's required action points to them.

Step 3: Apply the vendor's fix

• Ask the vendor which version fixes this CVE, since no source here names one.
• Apply it and record the version and date.

Step 4: Check for signs of misuse

• Review the appliance for file changes you cannot explain, going back to before 15 October 2026.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello, we need to know whether we run BeyondTrust Remote Support, and if so where and which version. CVE-2026-102764 affects all versions up to and including 26.2.3, and CISA lists it as exploited with a due date of 19 October 2026. The record names no fixed version, so please tell us the vendor's fix and mitigations. Please also tell us whether the appliance can be reached from the internet, and confirm in writing the version we run and that the fix is applied, as soon as you can. Thank you.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• File changes or new files on the appliance that nobody on your team made.
• Connections to the appliance from addresses you do not recognise.
• Anything unexpected on the appliance from 15 October 2026 onward.

The weakness behind it

The record classes this as CWE-290 (Authentication Bypass by Spoofing).

• CWE-290: Authentication Bypass by Spoofing →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

CISA's catalogue entry:

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

The CVE record, published by BT on 15 October 2026:

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Versions of BeyondTrust Remote Support the record lists as affected:

• all versions up to and including 26.2.3

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• Which version fixes this flaw: no source here names one.
• Whether an attacker needs a login or any prior access.
• What the record means by "the right conditions".
• How far file operations on the appliance can be taken.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.