CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
Summary
BeyondTrust Remote Support has a critical authentication bypass vulnerability that could allow a remote attacker to perform file operations. CISA is mandating action to apply mitigations, prioritizing security updates based on risk, and federal due date for remediation is October 19, 2026.
IFF Assessment
This vulnerability allows remote attackers to bypass authentication and perform unauthorized file operations, posing a significant risk to defenders.
Severity
This vulnerability allows for remote code execution via an authentication bypass, with a high impact on integrity and availability. The attack vector is network, and it is easily exploitable.
CISA KEV: Listed as actively exploited. Federal patch due: October 19, 2026. Known ransomware use: Unknown.
Defender Context
This vulnerability in BeyondTrust Remote Support requires immediate attention from defenders. Prioritizing patching and applying vendor-specified mitigations is crucial, especially for internet-facing assets, to prevent unauthorized file operations and potential system compromise. Organizations should adhere to CISA's guidance on risk-based security updates.