CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
CVSS 9.3 · Critical⚠ Actively exploited (CISA KEV)
9.3
CVSS score
Critical
Severity
Active
CISA KEV
No
Ransomware use
Oct 19, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on Oct 16, 2026, with a federal patch deadline of Oct 19, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Details
AffectedBeyondTrust · Remote Support
WeaknessCWE-290
CVSS base score9.3 (Critical)
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XPublishedOct 15, 2026
Added to CISA KEVOct 16, 2026
Federal patch deadlineOct 19, 2026
Known ransomware useNot documented
Frequently asked questions
Is CVE-2026-102764 being actively exploited?
Yes — CISA lists CVE-2026-102764 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-102764 affect?
CVE-2026-102764 affects BeyondTrust · Remote Support.
How do I fix CVE-2026-102764?
Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 19, 2026. Then check whether your personal data was exposed in any related breach.