CVE-2026-102764
BeyondTrust Remote Support improper origin validation allows unauthenticated file operations (CVE-2026-102764)
BeyondTrust Remote Support up to 26.2.3 has improper origin validation in internal messaging. An unauthenticated network attacker can perform file operations on the appliance. No fixed version is listed; CISA KEV and ENISA record active exploitation. Apply vendor mitigations or discontinue use.
What happened
CVE-2026-102764 is an improper origin validation weakness in internal messaging components of BeyondTrust Remote Support. The affected components did not adequately validate the origin of the messages they received. Under the right conditions, an attacker who can reach the appliance over the network can perform file operations on it, with no authentication and no user interaction required. The CVSS 4.0 base score is 9.3 (critical).
CISA's KEV catalogue, CISA SSVC and ENISA EUVD all record active exploitation. ENISA records exploitation since 16 October 2026. No fixed version is listed for this CVE.
Who is affected
BeyondTrust Remote Support, all versions up to and including 26.2.3, is affected. This is the appliance-based remote support product. If you operate Remote Support as an internet-facing service or as an internal access point for remote support sessions, treat it as affected. No fixed release is listed.
What to do now
No fixed version or patch is known for this CVE. Treat it as actively exploited.
- Apply the vendor mitigation guidance referenced in BeyondTrust's KB0024066 and BT26-05 blog entry. Follow the current instructions there.
- Determine which Remote Support appliances are reachable from the internet or untrusted networks, and restrict access to trusted management and user networks.
- If vendor mitigations cannot be applied, follow CISA's KEV required action: apply BOD 26-04 guidance and the associated forensics triage requirements, or discontinue use of the product.
- Complete the required action by CISA's due date of 19 October 2026.
- Monitor affected appliances for unexpected file operations and connections.
How to detect it
Monitor BeyondTrust Remote Support appliances for unexpected file creation, modification or deletion, especially on internet-exposed units. Review network access logs for unexpected connections, since the flaw is reachable over the network without credentials. The CVE record and CISA KEV entry do not publish specific indicators of compromise.
Beyond the patch
Active exploitation recorded by CISA KEV and ENISA EUVD, with no fixed version listed, makes detection and response the immediate priority. Our Managed Detection & Response service can monitor for post-exploitation activity on affected appliances. Our Virtual CISO Services can help identify internet-exposed Remote Support deployments and reduce their attack surface before this kind of flaw is reached.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Remote Support | – ≤ 26.2.3 | No fixed version listed yet |