CVE-2026-102764 is an authentication-bypass-by-spoofing flaw in internal messaging components of BeyondTrust's Remote Support appliance that lets a remote, unauthenticated attacker perform file operations on the device; a suspected China-nexus espionage actor exploited it as a zero-day from late August 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16.
Vulnerability summary
CVSS base score
9.8
Critical severity
EPSS score (FIRST)
1.2%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2026-102764 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| BeyondTrust Remote Support | cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:* | Self-hosted Remote Support through 26.2.3, remediated by patch BT26-05-RS (requires a baseline of 24.3.1 or later before the patch can be applied); BeyondTrust-hosted Remote Support SaaS instances were patched by the vendor on 2026-10-09 |
What does this mean for affected devices?
CVE-2026-102764 is an authentication bypass by spoofing (CWE-290) in internal messaging components of BeyondTrust Remote Support (formerly Bomgar), a remote-access and support appliance. NVD's description states the affected components "did not adequately validate the origin of the messages it received," and that "under the right conditions, this could allow an attacker to perform file operations on the appliance" without authenticating first (NVD).
NVD's own analysis gives CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; BeyondTrust's own CNA submission separately scores it CVSS v4.0 9.3 (critical) (NVD).
CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-16 with a required-action due date of 2026-10-19, confirming active exploitation (CISA KEV).
CISA's alert on the vulnerability reports that threat actors are exploiting the flaw to gain initial access, then establishing persistence, escalating privileges and moving laterally; it states affected self-hosted deployments run Remote Support 26.2.3 and earlier, that organizations must be on 24.3.1 or later before applying the BT26-05-RS patch, and that BeyondTrust's hosted SaaS instances were already patched on 2026-10-09. CISA's required actions include restricting external access to administrative interfaces, conducting forensic triage on appliances suspected of compromise, and rotating stored credentials after remediation (CISA Alert). BeyondTrust's own advisory page (BT26-05) is login-gated (HTTP 403); its details here are sourced to CISA's alert rather than the vendor page directly.
As of 2026-10-21, FIRST scores the probability of exploitation at 0.0118 (67.4th percentile) (FIRST EPSS).
Because this is a KEV-listed appliance flaw already used by a suspected espionage actor for roughly seven weeks before disclosure, self-hosted Remote Support operators should treat remediation as urgent: apply the BT26-05-RS patch after upgrading to at least 24.3.1, rotate any credentials the appliance had access to, and review logs for the exploitation window given reports that the actor deleted logs on compromised appliances.
Evidence
- Internal Remote Support messaging components fail to validate message origin, letting a remote unauthenticated attacker perform file operations on the appliance (CWE-290). — NVD
- NVD's own CVSS v3.1 base score is 9.8 (critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; BeyondTrust's own CNA submission separately scores CVSS v4.0 9.3. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-16, required action due 2026-10-19. — CISA KEV
- Affects self-hosted Remote Support 26.2.3 and earlier; fix is patch BT26-05-RS on a 24.3.1-or-later baseline, SaaS patched by vendor 2026-10-09; actively exploited by a suspected China-nexus actor to gain access, persist, escalate privileges and move laterally. — CISA Alert
- EPSS score is 0.0118 (67.4th percentile) as of 2026-10-21. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Who has been exploiting CVE-2026-102764, and for how long before disclosure?
CISA's alert reports threat actors — including a suspected China-nexus espionage actor — exploiting the flaw to gain initial access and then establishing persistence, escalating privileges and moving laterally, with exploitation beginning around late August 2026, roughly seven weeks before the CVE's 2026-10-15 publication (per CISA Alert).
Can a self-hosted BeyondTrust Remote Support appliance be patched directly to fix CVE-2026-102764?
Only from a sufficient starting point: organizations must be on at least version 24.3.1 before they can apply the BT26-05-RS patch; self-hosted deployments through 26.2.3 are affected, while BeyondTrust's own hosted SaaS instances were already patched by the vendor on 2026-10-09 (per CISA Alert).
What exactly fails to be validated in CVE-2026-102764?
Internal messaging components of BeyondTrust Remote Support do not adequately validate the origin of the messages they receive, which under the right conditions lets a remote, unauthenticated attacker perform file operations on the appliance (per NVD).
What should an organization do after applying the BT26-05-RS patch?
CISA's required actions go beyond patching: restrict external access to administrative interfaces, conduct forensic triage on appliances suspected of compromise, and rotate stored credentials after remediation, given reports that the actor deleted logs on compromised appliances (per CISA Alert).
Questions about this page?