PatchTheCEVCVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
87
Patch now
CRITICAL 9.8EXPLOITEDREMOTEUPGRADE
CVE-2026-102764 is a critical-severity flaw (CVSS 9.8) affecting remote support, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Why this priority
- Critical severity
- Exploited in the wild (CISA KEV)
- Covered by 7 security sources
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.2% (top 33%) |
| CISA exploited list | Yes, fix due 2026-10-19 |
| Weakness | CWE-290 |
| Published | 2026-10-15 |
| Last modified | 2026-10-17 |
Publisher (CNA): BeyondTrust · Vendor: beyondtrust
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Updated Record last modified
- Deadline CISA due date for US federal agencies to patch
beyondtrust remote support UPGRADE
Affected: <= 26.2.3
Fixed in: newer than 26.2.3
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy remote-support || rpm -q remote-support || remote-support --version
2. UPGRADE to newer than 26.2.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade remote-support
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade remote-support
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Exact fixes by distribution
Fedora 46 · retext · FIXED · 8.1.0-1.fc46 · FEDORA-2026-0602a84203 · source
sudo dnf upgrade --advisory=FEDORA-2026-0602a84203
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: Worthes/CVE-2026-102764-Proof-of-concept (3 stars)
- GitHub PoC: maxprog-svg/CVE-2026-102764 (0 stars)
Advisories and coverage
Official advisories
- HKCERT: BeyondTrust Remote Support Security Restriction Bypass Vulnerability 2026-10-20
- CISA Alerts and Advisories: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support 2026-10-16
- Canadian Cyber Centre: BeyondTrust security advisory (AV26-1054) – Update 1 2026-10-16
- Canadian Cyber Centre: AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764 2026-10-16
- CERT-SE Sweden: BeyondTrust varnar för kritisk nolldagssårbarhet 2026-10-16
- NCSC Netherlands: NCSC-2026-0437 [1.00] [H/H] Kwetsbaarheid verholpen in BeyondTrust Remote Support 2026-10-16
Research and news
- Rapid7 Blog: CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild 2026-10-19
- Mandiant / Google Cloud Threat Intel: ARMORY CASTLE Exploits BeyondTrust 2026-10-15
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.