CVE-2026-102764

CRITICAL

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/15/2026Modified: 10/17/2026

Related Intelligence (7)

CRITICALApt

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS) , its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3 , the vulnerability allows unauthenticated remote attackers to perform file operations on an affected appliance without user interaction. Versions 26.2.3 and

CVE-2026-102764CVE-2026-1731
Rapid7
CRITICALVulnerability

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

<p>CISA is aware of critical authentication bypass vulnerability <a href="https://www.cve.org/CVERecord?id=CVE-2026-102764" target="_blank">CVE-2026-102764</a>, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively ex

CVE-2026-102764
CISA Advisories
CRITICALZero Day

Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts. The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek .

CVE-2026-102764
SecurityWeek
CRITICALZero Day

BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert

Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral movement, according to Mandiant and Google Threat Intelligence Group. “Organizations should prepare for potential widespread

CVE-2026-102764CVE-2026-1731
CSO Online
CRITICALZero Day

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a

CVE-2026-102764
The Hacker News
HIGHVulnerability

CISA KEV: BeyondTrust Remote Support — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

CVE-2026-102764BeyondTrust Remote Support
CISA KEV
CRITICALVulnerability

NVD CRITICAL: CVE-2026-102764 — The vulnerability exists within internal components of BeyondTrust’s Remote Supp...

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

CVE-2026-102764
NIST NVD

References (4)

https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066Permissions Requiredhttps://nvd.nist.gov/vuln/detail/CVE-2026-102764US Government Resourcehttps://www.beyondtrust.com/blog/entry/bt26-05Vendor Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764US Government Resource