---
id: CVE-2026-102764
title: >-
  The vulnerability exists within internal components of BeyondTrust’s Remote
  Support product
summary: >-
  The vulnerability exists within internal components of BeyondTrust’s Remote
  Support product. The components did not adequately validate the origin of the
  messages it received. Under the right conditions, this could allow an attacker
  to p…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-290
vendor: beyondtrust
product: remote_support
affected:
  - remote_support <= 26.2.3
published: '2026-10-15'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T04:16:47.117'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102764'
references:
  - url: >-
      https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066
    label: 13061848-ea10-403d-bd75-c83a022c2891
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102764'
    label: 13061848-ea10-403d-bd75-c83a022c2891
  - url: 'https://www.beyondtrust.com/blog/entry/bt26-05'
    label: 13061848-ea10-403d-bd75-c83a022c2891
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - cve.org
epss: 0.1895
epssPercentile: 0.97286
kev: true
kevDateAdded: '2026-10-16'
kevDueDate: '2026-10-19'
kevRansomware: false
exploited: true
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/Worthes/CVE-2026-102764-Proof-of-concept'
    - 'https://github.com/maxprog-svg/CVE-2026-102764'
    - >-
      https://github.com/CompleTetech-Security/beyondtrust-remote-support-cve-2026-102764-check
  checkedAt: '2026-10-27T20:57:13.811Z'
exploitAvailable: true
zeroDay: true
ssvc:
  exploitation: active
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T17:50:04.760178Z'
scores:
  nvd: 9.8
  cna: 9.3
ingestedAt: '2026-10-15T21:45:11.430Z'
---

## Overview

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

## Affected

- `remote_support <= 26.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.