CVE-2026-102764criticalunder attackCWE-290

CVE-2026-102764: critical vulnerability in BeyondTrust Remote Support

Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

Published · Updated

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.3epss 1.2%
from disclosure to weapon1 days
Published on NVDOct 15
1st PoC+1d
CISA KEV+1d
exploitation probability
1.2%top 33% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
Action required by CISAfederal deadline: 2026-10-19

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

BeyondTrust Remote Support fails to properly verify where messages come from in its internal components. An attacker could exploit this to perform unauthorized file operations on the appliance.

Technical detail

CWE-290 improper origin validation allows attackers to send crafted messages to internal components without proper authentication or source verification. Under specific conditions, this enables arbitrary file operations on the affected appliance, requiring network access to the vulnerable component but potentially leading to complete system compromise.

Summary generated and translated by AI from the official description.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
BeyondTrust · Remote Support
public PoCs found — 1
githubgithub.com/Worthes/CVE-2026-102764-Proof-of-concept★ 2
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — BeyondTrust Remote Support

In the same product, most dangerous first.

CVE-2024-12356CRITICALCommand Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)EPSS 87.3%KEVCVE-2026-40139CRITICALCritical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.8%CVE-2026-40140HIGHHigh-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.6%CVE-2026-40141HIGHHigh-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%CVE-2026-40138CRITICALCritical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%
References
https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066https://nvd.nist.gov/vuln/detail/CVE-2026-102764https://www.beyondtrust.com/blog/entry/bt26-05https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764