Remote Support Vulnerability in BeyondTrust's Messaging Components
CVE-2026-102764

9.3CRITICAL

Key Information:

Vendor

Beyondtrust

Status
Remote Support
Vendor
CVE Published:
15 October 2026

Badges

📈 Trended📈 Score: 17,000💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 77%🦅 CISA Reported📰 News Worthy

What is CVE-2026-102764?

CVE-2026-102764 is a vulnerability found in the messaging components of BeyondTrust's Remote Support product. BeyondTrust's Remote Support is designed to enable secure remote connections for troubleshooting and technical support. The flaw arises from insufficient validation of the message origin within its internal components, which could allow attackers to conduct unauthorized file operations on the affected appliance. This vulnerability could enable malicious actors to manipulate the system in ways that might compromise the integrity or confidentiality of sensitive data, thereby posing a serious risk to organizations relying on this software for remote support functions.

Potential impact of CVE-2026-102764

  1. Unauthorized File Operations: Attackers could exploit the vulnerability to perform unapproved file manipulations, potentially leading to data loss, corruption, or exposure of sensitive information.

  2. System Compromise: By leveraging this vulnerability, attackers may gain unauthorized access to broader system functionalities, allowing them to escalate privileges or take control of the remote support appliance.

  3. Reputational Damage: Organizations affected by this vulnerability may face significant reputational harm due to potential data breaches or service interruptions, which could erode customer trust and impact business operations.

CISA has reported CVE-2026-102764

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-102764 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Remote Support 0 <= 26.2.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-102764-Proof-of-concept
Created by Worthes

News Articles

favicon imageWater Information Sharing And Analysis Center

(TLP:CLEAR) Vulnerability Notification - BeyondTrust Remote Support Actively Exploited - WaterISAC

ACTION MAY BE REQUIRED for utilities using self-hosted BeyondTrust Remote Support (formerly Bomgar) appliances running version 26.2.3 or earlier, as well as self-hosted BeyondTrust Privileged Remote Access...

2 weeks ago

favicon imageTechtimes

China Hacked BeyondTrust Enterprise Vaults With Zero-Day Active for Seven Weeks

BeyondTrust zero-day CVE-2026-102764 was exploited by Chinese state hackers for seven weeks before disclosure, letting attackers drain enterprise credential vaults and plant a reboot-surviving

2 weeks ago

favicon imageIt Security News

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild - IT Security News

Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764...

2 weeks ago

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102764
https://www.beyondtrust.com/blog/entry/bt26-05
https://beyondtrustcorp.service-now.com/csm?id=csm_kb_art...

EPSS Score

77% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 📈

    Vulnerability started trending

  • 🟡

    Public PoC available

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by Securityweek

  • Vulnerability published

  • Vulnerability Reserved

.