CVE-2026-102764: BeyondTrust Remote Support Bypass (KEV)

CVE-2026-102764 is an authentication-bypass-by-spoofing flaw in internal messaging components of BeyondTrust's Remote Support appliance that lets a remote, unauthenticated attacker perform file operations on the device; a suspected China-nexus espionage actor exploited it as a zero-day from late August 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16.

CVE-2026-102764 is an authentication bypass by spoofing (CWE-290) in internal messaging components of BeyondTrust Remote Support (formerly Bomgar), a remote-access and support appliance. NVD's description states the affected components "did not adequately validate the origin of the messages it received," and that "under the right conditions, this could allow an attacker to perform file operations on the appliance" without authenticating first (NVD).

NVD's own analysis gives CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; BeyondTrust's own CNA submission separately scores it CVSS v4.0 9.3 (critical) (NVD).

CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-16 with a required-action due date of 2026-10-19, confirming active exploitation (CISA KEV).

CISA's alert on the vulnerability reports that threat actors are exploiting the flaw to gain initial access, then establishing persistence, escalating privileges and moving laterally; it states affected self-hosted deployments run Remote Support 26.2.3 and earlier, that organizations must be on 24.3.1 or later before applying the BT26-05-RS patch, and that BeyondTrust's hosted SaaS instances were already patched on 2026-10-09. CISA's required actions include restricting external access to administrative interfaces, conducting forensic triage on appliances suspected of compromise, and rotating stored credentials after remediation (CISA Alert). BeyondTrust's own advisory page (BT26-05) returned an HTTP 403 (login-gated) when fetched for this page, so its details here are sourced to CISA's alert rather than the vendor page directly.

As of 2026-10-21, FIRST scores the probability of exploitation at 0.0118 (67.4th percentile) (FIRST EPSS).

Because this is a KEV-listed appliance flaw already used by a suspected espionage actor for roughly seven weeks before disclosure, self-hosted Remote Support operators should treat remediation as urgent: apply the BT26-05-RS patch after upgrading to at least 24.3.1, rotate any credentials the appliance had access to, and review logs for the exploitation window given reports that the actor deleted logs on compromised appliances.

• Internal Remote Support messaging components fail to validate message origin, letting a remote unauthenticated attacker perform file operations on the appliance (CWE-290). — NVD
• NVD's own CVSS v3.1 base score is 9.8 (critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; BeyondTrust's own CNA submission separately scores CVSS v4.0 9.3. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-16, required action due 2026-10-19. — CISA KEV
• Affects self-hosted Remote Support 26.2.3 and earlier; fix is patch BT26-05-RS on a 24.3.1-or-later baseline, SaaS patched by vendor 2026-10-09; actively exploited by a suspected China-nexus actor to gain access, persist, escalate privileges and move laterally. — CISA Alert
• EPSS score is 0.0118 (67.4th percentile) as of 2026-10-21. — FIRST EPSS