BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

What's on the official record

16 October — CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.10.21). The entry describes an authentication bypass by spoofing vulnerability (CWE-290) in BeyondTrust Remote Support that could allow a remote attacker to perform file operations on the appliance. CISA's remediation due date for federal civilian agencies is 19 October 2026. The record names no fixed version; BeyondTrust Remote Support is affected through 26.2.3. The catalog does not record known ransomware use. FIRST's EPSS model estimate is 0.012 (67th percentile, 2026-10-23). CISA's ADP SSVC assessment records exploitation as active, automatable yes, impact total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any BeyondTrust Remote Support appliance in your estate runs a version at or below 26.2.3, the affected range the CVE record states. Because the record names no fixed version, the decision is to isolate the appliance or restrict its exposure until a vendor advisory names a patched release. The catalog's required action points to applying mitigations in accordance with vendor instructions.

For a cyber underwriter, the record lets you check whether a policyholder's remote-support estate includes BeyondTrust Remote Support at or below 26.2.3. With no fixed version named, the record supports requiring a control — confirmation of vendor mitigations or isolation — before binding or renewing. The catalog does not record known ransomware use, so the record does not by itself support a ransomware-based pricing adjustment.

For a deal team, the record lets you scope diligence on any target that operates BeyondTrust Remote Support, checking the deployed version against the affected range through 26.2.3. Because the record names no fixed version, the condition to attach is confirmation of the vendor's mitigation path before close. The record names no victim or campaign, so the check it supports is a version check against the affected range.

What would change this call

A vendor advisory naming a fixed version for BeyondTrust Remote Support would change the platform owner's action from isolate to patch. A CISA update recording known ransomware use would change the underwriter's control requirement. A revised catalog entry naming a fixed version would change the deal team's condition.

What to check next

Confidence

Filed 25 October 2026 from the record dated 16 October 2026. The record is CISA's own catalog entry and the CVE record; the EPSS figure is FIRST's model estimate, not observed exploitation, and the SSVC assessment is CISA's ADP.

Sources

[1] BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-102764

[2] CVE record CVE-2026-102764 — https://www.cve.org/CVERecord?id=CVE-2026-102764

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog