CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | Cyberiack

Skip to content

Actively exploited: added to CISA’s KEV catalog on October 16, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: October 19, 2026.

Description from CISA’s KEV catalog.

Our analyses

BeyondTrust flaw was secretly exploited since late August, and patching is no longer enough

A suspected Chinese espionage group has exploited the BeyondTrust Remote Support flaw CVE-2026-102764 since late August. Here is why the patch isn't enough, and how to check your appliances.

Oct 16, 20263 min read

What to do

Check whether your estate includes BeyondTrust Remote Support, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (www.beyondtrust.com)
NVD entry (NIST)
CISA KEV catalog

Other BeyondTrust vulnerabilities

CVE-2026-1731Used by ransomwareFeb 13

BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability

All exploited BeyondTrust vulnerabilities