ZeroDayAlert

CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

BeyondTrust Remote Support Added to KEV 2026-10-16 Federal due 2026-10-19 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

BeyondTrust Remote Support is vulnerable to an authentication bypass flaw that allows unauthenticated remote file operations on the appliance. The vulnerability affects deployments exposed to network access; the specific affected versions are not listed in the CISA record. Both on-premises and cloud deployments may be in scope.

How to check whether this touches you

  • Search your asset inventory for BeyondTrust Remote Support appliances, including cloud-hosted instances and licence registrations.
  • Confirm whether each instance is reachable from the internet or from a network segment containing untrusted users; check firewall rules and network segmentation.
  • Query the running appliance version through its administrative interface or query API, and cross-reference against vendor security advisories for the affected range; note that version alone is not conclusive if backported patches are in use.
  • If you cannot determine the appliance version directly, request this information from your BeyondTrust vendor contact or support portal.

What to do

  1. Contact BeyondTrust support immediately to obtain the vendor's official patch or workaround guidance, and verify which versions are affected.
  2. If patching is not immediately possible, implement network controls to restrict access to the Remote Support appliance to only known, trusted administrative networks; use firewall rules and VPN enforcement to reduce exposure.
  3. Enable and retain all authentication and file operation logs on the appliance for the period from the vulnerability's initial introduction to the present; configure log export to a remote syslog server if available.
  4. Escalate to your information security team to ensure the remediation deadline of 2026-10-19 is tracked in your patching workflow, and confirm compliance with CISA BOD 26-04 risk-based prioritisation guidance.

If you find you were exposed

Exploitation of authentication bypasses typically precedes public disclosure, so you should review logs and file integrity records from at least 30 days before the public announcement date. Focus your hunt on unexpected file read, write, or delete operations, particularly those involving configuration or credential files. Log retention is often the limiting factor; confirm your appliance's log retention window now and archive older logs if available.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-102764 is being exploited. It cannot tell you whether Remote Support is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →