CVE-2026-102764

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.012 · 67 %ileexploit · PoCDENLUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · PoC

Likely / severe?

1.18% (67th) EPSS

CVSS 9.8 · critical

Is it mine?

4 products

Check your exposure

Who says so?

3 sources

cert_bund · ncsc_nl · nvd

added 2026-10-16remediate by 2026-10-19

required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

EPSS · scored 2026-10-24

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-290USCWE-290US

exploits (3)

Public proof-of-concept and weaponised exploit code.

affected products (4)

Products and version ranges known to be affected.

BeyondTrust BeyondTrust Remote Support <=26.2.3≤ 26.2.3cert_bundDE
BeyondTrust Remote Support≤ 26.2.3cert_bundDE
BeyondTrust Remote Support≤ vers:unknown/*ncsc_nlNL
beyondtrust remote support≤ 26.2.3nvdUScpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0437Kwetsbaarheid verholpen in BeyondTrust Remote SupportNL2026-10-16csaf · ncsc_nlNL
BeyondTrust heeft een kritieke kwetsbaarheid verholpen in BeyondTrust Remote Support.
WID-SEC-W-2026-4001BeyondTrust Remote Support: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-10-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in BeyondTrust Remote Support ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

sources

Which sources assert this record, and when.

cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2026-10-15modified 2026-10-17

references (4) nvd

External citations — patches, advisories, analysis.

https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066Permissions Required
https://nvd.nist.gov/vuln/detail/CVE-2026-102764US Government Resource
https://www.beyondtrust.com/blog/entry/bt26-05Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764US Government Resource

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan