BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.3Security Advisory

TL;DR 📌

  • BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
  • Highest CVSS: 9.3 (Critical).
  • Listed in CISA KEV (2026-10-16) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-102764.

What it is

CVE-2026-102764 is an authentication bypass by spoofing vulnerability in BeyondTrust Remote Support. The flaw sits in internal components of the product that fail to properly validate the origin of messages they receive. An attacker who can get a message to these components can have it treated as legitimate even though it did not come from a trusted source.

The CVSS 4.0 vector describes this as reachable over the network (AV:N) with low attack complexity (AC:L), no attack requirements (AT:N), no privileges required (PR:N) and no user interaction (UI:N). In practice this means an unauthenticated attacker with network access to the affected internal components can exploit the issue directly, without needing valid credentials or tricking a user.

The impact is described as the ability to perform file operations on the appliance. The advisory does not specify which files or directories are reachable, so treat this as a potential foothold on the appliance’s filesystem rather than a narrowly scoped read or write to a single known path.

This CVE is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 16 October 2026, so it is known to be exploited.

What to do

  • Check the BeyondTrust Remote Support advisory for your deployed version — fixed releases are not listed here, so confirm directly with BeyondTrust which build resolves CVE-2026-102764 and plan to patch to it.
  • Given this is in CISA KEV, prioritise remediation on an expedited timeline consistent with your KEV response process, rather than standard patch cycles.
  • Restrict network reachability to the Remote Support appliance’s internal components where possible; the attack path requires network access with no authentication, so reducing exposure (segmentation, ACLs, VPN-only access) limits risk while patching is scheduled.
  • Review appliance logs and file integrity on Remote Support systems for unexpected file operations, since the vulnerability’s impact is specifically file operations on the appliance.
  • Once patched, verify the fix against the version BeyondTrust confirms as remediated, since no fixed version or last-vulnerable version is stated in the published advisory data at this time.

For leadership 🧭

Executive summary. A critical, network-exploitable flaw in BeyondTrust Remote Support lets an attacker with no credentials perform file operations on the appliance, and it is already being exploited in the wild per CISA KEV. This needs urgent attention now, not at the next scheduled patch cycle.

Why it matters:

  • Internal components of Remote Support don’t validate message origin, so an unauthenticated attacker on the network can spoof trusted messages and reach the appliance directly (AV:N, PR:N, UI:N).
  • The disclosed impact is file operations on the appliance filesystem; scope isn’t limited to a named path, so treat it as a potential foothold rather than a narrow read/write.
  • Listed in CISA KEV as of 16 October 2026, meaning this is known to be exploited, not theoretical.
  • No fixed or last-vulnerable version is published yet, so confirming the remediated build requires direct contact with BeyondTrust rather than a routine version check.

Now / Next / Later:

  • Now: Contact BeyondTrust directly to confirm which build fixes CVE-2026-102764, since no fixed version is listed, and restrict network access to the Remote Support appliance’s internal components in the meantime.
  • Next: Patch to the confirmed fixed release on an expedited schedule in line with your KEV response process, and review appliance logs and file integrity for unexpected file operations in the meantime.
  • Later: Tighten network segmentation and ACLs around Remote Support appliances so internal components aren’t reachable from untrusted networks, reducing exposure for future origin-validation flaws in the same product line.

Source