BeyondTrust Remote Support flaw allows file operations; exploited in the wild

What happened

BeyondTrust has disclosed a vulnerability, tracked as CVE-2026-102764, in internal components of its Remote Support product. Those components fail to properly check where incoming messages come from. The weakness is classified as an authentication bypass through spoofing (CWE-290).

When certain conditions are met, an attacker could abuse this gap to perform file operations on the appliance. The details of those conditions are not described in the data available to us.

The flaw was published on 2026-10-15. It is being actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-16.

Who is affected

Organizations running BeyondTrust Remote Support are affected. The listed affected versions are those up to and including 26.2.3.

The vendor has not confirmed a fixed version in the data available to us, so administrators should check the BeyondTrust advisory to determine which builds address the issue.

How serious is it

The flaw carries a CVSS 4.0 base score of 9.3, rated critical. According to the scoring vector, it can be reached over the network without credentials or user interaction and has a high impact on confidentiality, integrity and availability of the affected system.

Attackers are already exploiting it, and CISA has set a remediation due date of 2026-10-19 for federal agencies. The EPSS score, an estimate of how likely the flaw is to be exploited, is 0.77994 as of 2026-11-09. Use by ransomware groups is not known.

What you should do

1. 1Identify all BeyondTrust Remote Support instances running version 26.2.3 or earlier.
2. 2Follow the BeyondTrust advisory and apply the vendor's mitigations or updates as soon as possible.
3. 3Review affected appliances for signs of compromise, in line with CISA's forensics triage guidance.
4. 4Stop using the product if mitigations cannot be applied, as CISA advises.
5. 5Assess the internet exposure of each Remote Support appliance.
6. 6Monitor the vendor advisory for confirmation of a fixed version.

Quick facts