Article
CISA adds BeyondTrust Remote Support flaw to its exploited list
CISA says a critical BeyondTrust Remote Support flaw, CVE-2026-102764, is exploited. Versions 26.2.3 and earlier need the BT26-05-RS patch.
Read more
Exploited vulnerability
BeyondTrust Remote Support authentication bypass (CVE-2026-102764)
A flaw in BeyondTrust Remote Support, a tool that support teams use to reach and control other computers.
- On CISA KEV
- CVE ID
- CVE-2026-102764
- CVSS
- 9.8 Critical (CVSS v3.1, NVD); 9.3 Critical (CVSS v4.0, CNA record in NVD)
- CISA KEV
- Listed
- Affected product
- Remote Support
- Exploited
- 16 October 2026 (CISA KEV listing)
- Published
- October 2026
In short
CVE-2026-102764 is a flaw in BeyondTrust Remote Support, a tool that support teams use to reach and control other computers. Internal components do not properly check where the messages they receive come from, so an outsider without a login can perform file operations on the appliance. CISA lists it as exploited.
- CVECVE-2026-102764
- ProductBeyondTrust Remote Support
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedPatch self-hosted appliances · Check how you are hosted
What it allows
A remote attacker with no credentials and no user interaction can perform unauthorized file operations on an affected Remote Support appliance. The Canadian Cyber Centre says this can enable arbitrary file uploads and may result in full compromise of the appliance. CISA says actors are using the flaw for initial access, then persistence, privilege escalation and lateral movement. NVD lists CVSS v3.1 9.8 and CVSS v4.0 9.3, both Critical.
Who is affected
BeyondTrust Remote Support versions 26.2.3 and earlier are affected, per the NVD record and the Canadian Cyber Centre. The fix for self-hosted appliances running 24.3.1 up to 26.2.3 is the BT26-05-RS patch from BeyondTrust Security Advisory BT26-05. Appliances older than 24.3.1 must be upgraded first, then patched. Per CISA and the Canadian Cyber Centre, BeyondTrust-hosted (SaaS) Remote Support is already patched, and the Cyber Centre says the SaaS patch was applied as of 9 October 2026.
NVD published the record on 15 October 2026. CISA published its alert and added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 16 October 2026, with a due date of 19 October 2026. The KEV entry does not mark it as used in ransomware campaigns (field shows Unknown). CISA does not attribute the activity to a named actor, so this page does not attribute it either.
Timeline
-
9 Oct 2026
Per the Canadian Cyber Centre, the vendor had patched all Remote Support SaaS customers by this date.
-
15 Oct 2026
Vendor advisory BT26-05 released, and NVD published the CVE record.
-
16 Oct 2026
CISA published its alert and added the CVE to the KEV catalog. The Canadian Cyber Centre issued alert AL26-025.
-
19 Oct 2026
CISA KEV due date for federal agencies to apply mitigations.
What to do
-
Patch self-hosted appliances
Apply the BT26-05-RS patch from BeyondTrust Security Advisory BT26-05 on versions 24.3.1 to 26.2.3. If you run a version older than 24.3.1, upgrade first, then patch. Confirm automatic updates are on.
-
Check how you are hosted
Find every Remote Support deployment and note whether it is SaaS or self-hosted, and which version it runs. SaaS deployments are already patched, per CISA.
-
Limit exposure
Allow outside access only to the services users need, and keep administrative interfaces on trusted networks.
-
Hunt for compromise
Look for unrecognized privileged or administrative sessions, unrecognized script files, gaps in logs or log forwarding, and unauthorized changes to accounts, permissions or session policies. Collect appliance, web application firewall, reverse proxy and perimeter firewall logs for the exposure window.
-
If you suspect compromise
Isolate the appliance and keep a snapshot or forensic image. Rebuild from a known-good state, apply the patch, rotate every credential the appliance stored or injected, revoke active support sessions and review new MFA registrations on privileged accounts.
Questions
What is CVE-2026-102764?
It is an authentication bypass by spoofing (CWE-290) in BeyondTrust Remote Support. Internal components do not adequately validate the origin of messages they receive, which lets an attacker perform file operations on the appliance. NVD lists CVSS v3.1 9.8.
Which versions are affected and what is the fix?
Remote Support 26.2.3 and earlier. Self-hosted appliances on 24.3.1 to 26.2.3 need the BT26-05-RS patch. Older appliances must be upgraded first. SaaS deployments are already patched, per CISA.
Is CVE-2026-102764 exploited?
Yes. CISA says threat actors are actively exploiting it and added it to the KEV catalog on 16 October 2026, with a due date of 19 October 2026.
In our research
Sources
- CISA urges patching critical vulnerability in BeyondTrust Remote Support CISA
- Known Exploited Vulnerabilities catalog entry for CVE-2026-102764 CISA
- CVE-2026-102764 record NIST NVD
- AL26-025 Critical vulnerability impacting BeyondTrust Remote Support (CVE-2026-102764) Canadian Centre for Cyber Security
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 45 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.