Zero Radar
← feed
CriticalVulnerabilityCVE-2026-102764updated 25 Oct 2026, 17:20 UTC

BeyondTrust Remote Support: attackers can bypass login and change files on the appliance

Attackers on the internet may be able to pretend to be trusted internal parts of the product and get past the login check. Once inside, they can read, add, or change files on the device that runs your remote support.

Exploited (CISA KEV)Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?YesConfirmed by CISA KEV · 16 Oct 2026
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends crafted messages over the network
  2. 2Internal componentFails to check where messages come from
  3. 3Login bypassedAttacker is treated as trusted
  4. 4File operationsFiles can be read or changed
  5. ResultAttacker gains file control on the appliance

What happened

An authentication bypass by spoofing flaw in internal components of BeyondTrust Remote Support, which fail to verify the origin of incoming messages, allowing remote file operations on the appliance.

Why it is dangerous: A remote attacker could take control of files on the appliance that handles remote access to your systems, so anyone using or exposing this product is at serious risk. CISA has confirmed it is being exploited.

Are you affected?

You are affected if you run BeyondTrust Remote Support, especially if the appliance is reachable from the internet.

BeyondTrust Remote Support (versions not stated in the provided material)

What to do

  1. Check whether any BeyondTrust Remote Support appliance is exposed to the internet and restrict access to it immediately
  2. Apply the mitigations or patches from the vendor (BeyondTrust) as soon as possible
  3. Follow CISA BOD 26-04 and its Forensics Triage Requirements, and review the appliance for signs of compromise
  4. If no mitigation is available, stop using the product until a fix is released, as CISA directs

Timeline

  1. 15 Oct 2026, 21:36 UTC
    Publicly disclosed
  2. 16 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-102764 · GHSA-pf95-v8m2-73q8
CVSS
9.3 / 10
EPSS
19% chance of exploitation within 30 days
Disclosed
15 Oct 2026, 21:36 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

BeyondTrust Remote Support: attackers can bypass login and change files on the appliance · Zero Radar