CVE-2026-102764 was published by NVD on October 15, 2026. The next day, October 16, CISA added it to the KEV catalog with a remediation deadline of October 19 — three days.
One day between publication and evidence of exploitation: there was no window in which this flaw was "only theoretical". If you run an exposed BeyondTrust Remote Support appliance, this is today's priority.
The Vulnerability
| Field | Value |
|---|---|
| CVE | CVE-2026-102764 |
| CVSS 3.1 (NVD) | 9.8 (CRITICAL) |
| 3.1 vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS 4.0 (BeyondTrust) | 9.3 (CRITICAL) |
| Type | Authentication bypass by spoofing (CWE-290) |
| Authentication | None |
| NVD publication | 2026-10-15 |
| Added to CISA KEV | 2026-10-16 |
| CISA deadline | 2026-10-19 |
NVD description:
The vulnerability exists within internal components of BeyondTrust's Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
What the description says — and doesn't
The pattern is a familiar one: internal components trust messages without checking where they come from. An attacker who can forge those messages poses as a legitimate component, and the appliance does what it's told — here, file operations.
The wording is cautious ("under the right conditions"); the vector is not: network, low complexity, no privileges, no user interaction. CISA's SSVC assessment points the same way: exploitation active, and automatable. An automatable flaw in a product that is internet-facing by design is a flaw that will be mass-scanned.
"File operations" may sound milder than code execution. On an appliance the line is thin: writing the right file in the right place often means dropping a configuration, a script or a key that opens the next step.
Affected Versions
| Product | Affected versions (NVD bound) | Fixed version |
|---|---|---|
| BeyondTrust Remote Support | 26.2.3 and earlier | not published by NVD — see advisory BT26-05 |
⚠️ NVD gives an inclusive upper bound ("up to 26.2.3") but no fixed version number. We won't make one up: the release or patch to apply is in BeyondTrust advisory BT26-05 and knowledge-base article KB0024066, both referenced by NVD.
Check the advisory for cloud instances too: NVD doesn't say whether BeyondTrust patches them itself or whether action is needed on your side.
Why Remote Access Products Are Priority Targets
BeyondTrust Remote Support exists to take control remotely of an organization's workstations and servers, often with elevated rights. Compromising the appliance can mean inheriting that power: sessions, stored credentials, access to managed machines.
This isn't the first time the product has been targeted: in late 2024, CVE-2024-12356 in Remote Support was also added to KEV. Remote access tools keep coming back to the catalog for the same reason — they are exposed by design and lead to everything else.
The KEV entry for CVE-2026-102764 also explicitly calls for forensic triage (BOD 26-04 requirements) on top of mitigation: CISA's position is that an appliance exposed during the exploitation window must be examined, not just updated.
Detection
- Modified or new files on the appliance outside documented maintenance
- Support sessions or accounts nobody recognizes in the appliance logs
- Unexplained configuration changes: users, groups, session policies, directory integrations
- Outbound connections initiated by the appliance to destinations unrelated to its function
- Unusual activity on managed endpoints: remote sessions outside support hours, tools launched from the support console
The appliance logs and session recordings are the first source. Export them before any update if you suspect exploitation: an upgrade can overwrite useful traces.
Mitigation
1. Apply the fix from advisory BT26-05
The CISA deadline is October 19. For an internet-facing appliance, handle it now.
2. Reduce exposure in the meantime
- Restrict access to the appliance's administrative interface to admin addresses
- If the appliance doesn't need to be reachable from the internet at all times, take it off public exposure temporarily
3. If the appliance was exposed during the exploitation window
- Preserve logs and appliance state before intervening
- Rotate credentials stored in the tool and those of associated service accounts
- Review remote sessions opened from the appliance over the period
- Check the endpoints and servers accessed from the console, starting with the most sensitive
Why Continuous Monitoring of Your Remote Access Tools Matters
One day between publication and the KEV addition: no weekly vulnerability review would have caught this CVE before it was exploited. What makes the difference is knowing in advance which products and versions you run.
With cveo.tech, inventory your remote access appliances and software with their exact versions, and get an automatic alert as soon as a critical CVE affects them or enters the CISA KEV catalog.