CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS) , its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3 , the vulnerability allows unauthenticated remote attackers to perform file operations on an affected appliance without user interaction. Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied. BeyondTrust has confirmed that exploitation in the wild has already occurred prior to disclosure. Its October 16 report dates the two known Remote Support compromises to August 29, 2026: one BeyondTrust-hosted instance and one self-
- Vendor
- BeyondTrust
- Product
- Remote Support / PRA
- CVSS v4.0
- 9.3
- EPSS
- 0.19 (p97)
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Remote access
Why it ranks 82 (Critical)
- Exploitation observed in the wild
- CVSS v4.0 9.3 critical
- EPSS 0.19 (elevated)
- Exposed product class: remote access
- Covered by 8 independent sources
- Fix available
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Rapid7 research (rapid7.com)
- CVE-2026-102764 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-1731 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.