CVE-2026-102764
published 2026-10-15CVE-2026-102764: The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the…
PriorityP185critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-10-19
Exploited in the wild
EPSS
1.18%
67.4th percentile
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| beyondtrust | remote_support | <= 26.2.3 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.3CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
BeyondTrust Remote Support up to 26.2.3 data authenticity (WID-SEC-2026-4001)
vuldb·2026-10-16·CVSS 9.8
CVE-2026-102764 [CRITICAL] BeyondTrust Remote Support up to 26.2.3 data authenticity (WID-SEC-2026-4001)
A vulnerability marked as very critical has been reported in BeyondTrust Remote Support up to 26.2.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to insufficient verification of data authenticity.
This vulnerability is listed as CVE-2026-102764. The attack may be initiated remotely. In addition, an exploit is available.
GHSA
The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
ghsa_unreviewed·2026-10-15
CVE-2026-102764 [CRITICAL] CWE-290 The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
VulnCheck
BeyondTrust remote_support Authentication Bypass by Spoofing
vulncheck·2026·CVSS 9.3
CVE-2026-102764 [CRITICAL] BeyondTrust remote_support Authentication Bypass by Spoofing
BeyondTrust remote_support Authentication Bypass by Spoofing
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Affected: BeyondTrust remote_support
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/
CISA
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
cisa·2026-10-16·CVSS 9.8
CVE-2026-102764 [CRITICAL] CWE-290 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
Vulnerability: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
Affected: BeyondTrust Remote Support
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
blogs_hackernews·2026-10-19
CVE-2026-102764 ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.
This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to.
Some attacks were cleve
Checkpoint
19th October – Threat Intelligence Report
blogs_checkpoint·2026-10-19·CVSS 8.8
CVE-2026-35029 [HIGH] 19th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 19th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents. Unauthorized access to an external system exposed names, addresses, Social Security information, and driver’s license numbers, according to regulatory notifications filed by the company.
Hackernews
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
blogs_hackernews·2026-10-16·CVSS 8.2
CVE-2026-102764 [HIGH] China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.
The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance.
"The vulnerability exists within internal components of Remote Support," BeyondTru
2026-10-15
Published
2026-10-16
Added to CISA KEV
Exploited in the wild