BeyondTrust Remote Support flaw is being exploited: apply vendor fixes now
CISA says attackers are exploiting CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support. A remote attacker could perform file operations on the appliance, so apply the vendor's mitigations now.
What it is: BeyondTrust Remote Support has an authentication bypass by spoofing flaw, tracked as CVE-2026-102764. It could let a remote attacker perform file operations on the appliance without proper login checks.
Who is affected: Organizations that run BeyondTrust Remote Support. We were not given the affected versions, so check the vendor's advisory to see if your version is in scope.
Is it being exploited: Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-16, which means it has evidence of real-world exploitation. Whether ransomware groups are using it is unknown.
What to do: - Apply the vendor's mitigations or updates as soon as possible, following the vendor's instructions. - Check which of your Remote Support appliances are reachable from the internet and treat those first. - If you use the cloud service, follow the vendor's and CISA's guidance for cloud services. - If no mitigation is available, CISA advises stopping use of the product. - Look for signs of past compromise. CISA points to its Forensics Triage Requirements for this.
US federal agencies have a due date of 2026-10-19. Everyone else should treat that as a sign of how urgent this is.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.