CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing

Background

BeyondTrust Remote Support is a privileged remote access and support platform used by IT teams and vendors to establish controlled remote sessions into managed systems, frequently as part of a broader privileged access management (PAM) deployment. Because Remote Support appliances are explicitly designed to be trusted gateways for privileged technical access, any authentication weakness in the product directly undermines the security boundary it exists to enforce.

CVE-2026-102764 is an authentication bypass by spoofing vulnerability that allows a remote attacker to perform file operations on the BeyondTrust Remote Support appliance without legitimate credentials. BeyondTrust products — including Remote Support and the related Privileged Remote Access line — have been targeted in prior high-profile incidents, making this a product family with an established track record as an attacker target of interest for both initial access and lateral movement into privileged environments.

Technical Mechanism

This vulnerability is classified under CWE-290, Authentication Bypass by Spoofing. This weakness class occurs when an authentication mechanism relies on a value or signal that can be forged or impersonated by an attacker — such as a spoofable identity assertion, a trust decision based on an easily-forged header, source identifier, or token — rather than on a cryptographically verified credential.

Based on the KEV description, the exploitable condition in Remote Support works roughly as follows:

1. The targeted component of the appliance makes an authentication or authorization decision based on a value that is intended to identify a trusted caller (for example, an internal service, a specific session context, or a particular client identity).
2. Because that identifying value can be spoofed or forged by an external party without needing to present valid primary credentials, an attacker crafts a request that presents the spoofed identity marker.
3. The appliance accepts the spoofed assertion as legitimate and grants access to functionality gated behind it — in this case, file operations on the appliance — without requiring the attacker to authenticate through the intended credential-based path.
4. The result, per CISA’s description, is that “a remote attacker [can] perform file operations on the appliance,” which could include reading, writing, or manipulating files that back the application’s configuration, session data, or other sensitive appliance state.

The CVSS 9.8 score reflects a network-exploitable, low-complexity vulnerability requiring no privileges and no user interaction, consistent with a pre-authentication bypass of this nature.

Real-World Exploitation Evidence

CVE-2026-102764 is listed in CISA’s KEV catalog, with a dateAdded of 2026-10-16 — only three days before the CISA remediation deadline of 2026-10-19, indicating CISA treated this as an urgent, actively-exploited issue requiring an unusually tight remediation window. KEV inclusion itself confirms CISA has evidence of active exploitation in the wild.

CISA lists knownRansomwareCampaignUse as “Unknown” for this entry, meaning CISA has not confirmed this specific vulnerability is tied to a named ransomware campaign as of KEV addition. Given the privileged nature of Remote Support deployments and BeyondTrust’s prior history as an exploited vector, organizations should not interpret “Unknown” as indicating low risk.

No specific threat actor or campaign name has been publicly attributed to exploitation of CVE-2026-102764 in the data available to us. The KEV listing confirms real-world exploitation occurred; attribution detail has not yet been made public. BeyondTrust’s own advisory (BT26-05) is the authoritative source for further updates.

Impact Assessment

An authentication bypass that permits file operations on a privileged remote-access appliance carries severe consequences even without a direct code-execution primitive confirmed in the available data:

• Confidentiality: File read access on the appliance could expose session recordings, configuration files, stored credentials, or other sensitive data that Remote Support holds as part of its privileged-access brokering role.
• Integrity: File write access could allow an attacker to modify appliance configuration, plant malicious files, or tamper with session logs or audit trails — potentially as a stepping stone toward further compromise, including code execution.
• Availability: File manipulation could corrupt the appliance’s operation, disrupting legitimate privileged remote-access workflows for IT and support staff.

Sector-specific risk: Because Remote Support and PAM tooling are specifically deployed to broker trusted, privileged access, organizations across managed services, enterprise IT, and any sector relying on BeyondTrust for vendor or internal privileged access face elevated risk — a compromised Remote Support appliance threatens the integrity of every privileged session it has ever brokered trust for.

Affected Versions

The exact affected version range is not specified in the KEV data provided here. Organizations should consult BeyondTrust’s advisory BT26-05 for the definitive affected and patched version list:

Remediation Steps

CISA’s required action directs applying vendor mitigations per BOD 26-04 risk-based patching guidance, following Forensics Triage Requirements, and discontinuing use of the product where mitigation is unavailable — particularly notable given the compressed remediation window.

1. Apply the BeyondTrust patch referenced in advisory BT26-05 to all Remote Support appliances immediately, given the narrow window between KEV addition and the CISA deadline.

# Confirm current Remote Support appliance build/version
# (exact command depends on your BeyondTrust admin console/API access)
curl -sk https://<your-remote-support-host>/api/config/version

2. Restrict appliance network exposure — confirm the Remote Support management and file-operation interfaces are not directly reachable from the public internet without additional network controls.
3. Follow Forensics Triage Requirements on any internet-facing, unpatched appliance given confirmed active exploitation, treating it as potentially already compromised.
4. Audit recent file operations on the appliance for anything inconsistent with normal administrative activity, especially during the period before the patch was applied.
5. Rotate credentials and session tokens associated with the appliance following patching, given the risk of exposure during the vulnerable window.

Detection Guidance

• Review appliance access logs for authentication events that rely on spoofable identity markers (headers, session tokens, source identifiers) rather than full credential validation, particularly from unexpected source addresses.
• Monitor for file read/write operations on the appliance that do not correspond to an authenticated administrative session in the access logs.
• Flag any unexplained changes to appliance configuration files, session data, or audit logs that coincide with unauthenticated or anomalously authenticated access.
• Exact IOC and signature guidance should be sourced from BeyondTrust’s advisory BT26-05 and your security vendor’s threat intelligence feeds as further detail becomes available.

Timeline

References

• BeyondTrust Security Advisory — BT26-05
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2026-102764