CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing

Exploited in the wild Critical 9.3 Published 15 Oct 2026 Updated 17 Oct 2026

Attackers can perform file operations on the BeyondTrust Remote Support appliance due to improper origin validation in internal messaging components.

Exploited in the wild: Since 16 Oct 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-102764?

CVE-2026-102764 is a critical vulnerability in BeyondTrust Remote Support, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Weakness: CWE-290

Which versions are affected by CVE-2026-102764?

It affects 1 product.

Products include Beyondtrust Remote Support.

How do I fix CVE-2026-102764?

No fix has been published for CVE-2026-102764 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 19 Oct 2026.

Is CVE-2026-102764 being exploited?

Yes. Attackers have exploited CVE-2026-102764 in the wild since at least 16 Oct 2026.

Public exploit code: 3 proofs of concept on GitHub.

CVE-2017-5996 Privilege escalation in n/a High 7.8

Sources

Also known as GHSA-pf95-v8m2-73q8.