https://www.phllaps.net/tags/beyondtrust/ Recent content in BeyondTrust on PhllapsNET Hugo en-gb Fri, 16 Oct 2026 00:00:00 +0000 https://www.phllaps.net/posts/beyondtrust-remote-support-authentication-bypass-by-spoofing-vulnerability/ Fri, 16 Oct 2026 00:00:00 +0000 https://www.phllaps.net/posts/beyondtrust-remote-support-authentication-bypass-by-spoofing-vulnerability/ <div style="background:#b91c1c;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: CRITICAL — CVSS 9.3</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.</li> <li>Highest CVSS: <strong>9.3 (Critical)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-10-16) — this is being exploited in the wild.</li> <li><strong>Check the advisory for fixed releases</strong> — remediation detail is in the vendor link below.</li> <li>CVEs: CVE-2026-102764.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>CVE-2026-102764 is an authentication bypass by spoofing vulnerability in BeyondTrust Remote Support. The flaw sits in internal components of the product that fail to properly validate the origin of messages they receive. An attacker who can get a message to these components can have it treated as legitimate even though it did not come from a trusted source.</p>