KRITIEK · CVSS 9.3
ACTIEF MISBRUIKT
CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
| Leverancier | BeyondTrust |
|---|---|
| Product | Remote Support |
| CVSS-score | 9.3 · CVSS 4.0 · KRITIEKCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| EPSS | 78,0% (percentiel 100) |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 16 okt 2026 |
| CISA-deadline (Amerikaanse overheid) | 19 okt 2026 |
| Zwakte (CWE) | CWE-290 |
| Gepubliceerd in NVD | 15 okt 2026 |
| Laatst gewijzigd in NVD | 17 okt 2026 |
| NVD-status | Analyzed |
Getroffen versies
| Product | Getroffen versies | Opgelost in |
|---|---|---|
| Beyondtrust Remote Support | tot en met 26.2.3 | – |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Beschrijving (NVD, Engels)
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
BRONNEN
Andere lekken bij BeyondTrust
- CVE-2026-1731: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
- CVE-2024-12686: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability
- CVE-2024-12356: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 17 okt 2026.