Live › vulnerability › CVE-2026-102764
Go to dashboardImproper origin validation (CWE-290) in an internal messaging component of BeyondTrust Remote Support lets an unauthenticated remote attacker perform file operations, including arbitrary file upload, on the appliance. CVSSv4 9.3. Exploited in the wild since 2026-08-29 (Mandiant: SAWFLY web shell, BARECLAW tunneler, root escalation). In CISA KEV since 2026-10-16. SaaS was patched 2026-10-09; self-hosted appliances need the patch applied. Self-hosted Privileged Remote Access shares the code; BeyondTrust has found no exploit path there but recommends patching.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| BeyondTrust Remote Support | vendor | – | – |
| BeyondTrust Remote Support | vendor | <= 26.2.3 without BT26-05-RS patch | BT26-05-RS patch (v24.3.1 - v26.2.3) |
| beyondtrust remote support | vendor | <= 26.2.3 | – |
26.2.3 are affected without the patch)24.3.1 to 26.2.3) in the /appliance interface24.3.1 must upgrade first, then patchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-102764")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.