BeyondTrust Remote Support improper origin validation allows unauthenticated file operations (CVE-2026-102764)

What happened

CVE-2026-102764 affects internal messaging components of BeyondTrust Remote Support. According to the CVE record, these components did not adequately validate the origin of the messages they received. Under the right conditions, that allows an attacker to perform file operations on the appliance.

The flaw is scored 9.3 critical under CVSS 4.0. The vector indicates a network attack with no privileges required and no user interaction, with high impact to confidentiality, integrity and availability of the affected appliance.

Exploitation is active. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on 2026-10-16, CISA SSVC rates exploitation as active, and ENISA EUVD records exploitation since 2026-10-16. No vendor statement on exploitation is listed.

Who is affected

BeyondTrust Remote Support versions up to and including 26.2.3 are affected, according to the CVE record. No fixed version is listed. Remote Support appliances that are reachable from the internet or other untrusted networks should be treated as exposed until isolation or mitigation is confirmed.

What to do now

1. Determine whether your Remote Support appliance is reachable from the internet or other untrusted networks. If it is, restrict access immediately using firewall rules or network segmentation, or take the appliance offline.
2. Review the vendor advisory KB0024066 and blog entry BT26-05 listed in the references. No fixed version has been published; do not treat any version as fixed.
3. Treat this as a CISA KEV matter. CISA's due date is 2026-10-19. CISA's required action is to apply mitigations in accordance with vendor instructions, evaluate each asset's internet exposure, and follow BOD 26-04 guidance. If mitigations are unavailable, discontinue use of the product.
4. If the appliance may have been exposed, preserve logs and begin incident response.

How to detect it

Because the flaw permits file operations on the appliance, review the Remote Support host for unexpected file creation, modification or deletion, and for unexpected processes. Check network and authentication logs for connections to the appliance from unusual IP addresses, particularly any access to internal messaging components. CISA's KEV entry references forensics triage requirements, so preserve relevant logs if exposure is suspected.

Beyond the patch

With exploitation already active and no published fix, the immediate priorities are containment and determining whether any appliance has been touched. Managed Detection & Response (MDR) and Incident Response Retainer provide detection and response for exactly this situation. Because the attack is network-based and requires no credentials, Virtual CISO Services (vCISO) can help assess which appliances are exposed and plan isolation.