BeyondTrust Remote Support: critical CVE-2026-102764 exploited

What CVE-2026-102764 is and who is affectedBeyondTrust Remote Support, the remote-access appliance many organisations use so their IT staff and extern...

What CVE-2026-102764 is and who is affected

BeyondTrust Remote Support, the remote-access appliance many organisations use so their IT staff and external providers can reach internal systems, carries a critical flaw tracked as CVE-2026-102764. Its official name is the BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability, and it is classified under CWE-290, authentication bypass by spoofing.

According to the National Vulnerability Database (NVD) of NIST, the problem sits in internal components of the product: they did not adequately validate the origin of the messages they received. Under the right conditions, an attacker could exploit that gap to perform file operations on the appliance itself. The CISA description reaches the same conclusion: a remote attacker could carry out file operations on the appliance without going through proper authentication.

The severity is CVSS 4.0 score of 9.3, rated CRITICAL, with a vector showing network access, low complexity, no privileges required and no user interaction. In plain terms, no password and no trick on an employee are needed. The affected range published by NVD covers BeyondTrust Remote Support up to and including version 26.2.3. The vulnerability was published in NVD on 15 October 2026.

Any Catalan or Spanish SME, online shop or small IT department that runs this appliance, whether on its own infrastructure or managed by a provider, should treat it as its own problem. Remote support tools are, by design, a doorway into the corporate network.

Why it is urgent: already exploited in real attacks

This is not a theoretical risk sitting in a database. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalogue on 16 October 2026, which means there is confirmed evidence of exploitation in real attacks. The same catalogue sets a remediation deadline of 19 October 2026 for US federal agencies, and that three-day window says a lot about how seriously the flaw is being taken.

CISA's required action is to apply the mitigations described in the vendor's instructions, in line with its BOD 26-04 guidance on prioritising security updates by risk and its forensics triage requirements. For cloud services, the same guidance applies, and if no mitigation is available the recommendation is to stop using the product. Each organisation is also expected to assess how exposed each asset is to the internet. The material does not record this vulnerability as used in ransomware campaigns, so that link should not be assumed.

For a company in Lleida, Barcelona, Tarragona or Girona, the practical reading is simple: an internet-facing appliance with a critical authentication bypass, actively exploited, is one of the highest-priority items on any patching list this week.

What to do today

Check whether you use it and in which version. Confirm whether BeyondTrust Remote Support is deployed, directly or through a managed service provider, and compare the installed version against the affected range up to 26.2.3.
Apply the vendor's update or mitigation. The reference is BeyondTrust's advisory BT26-05, together with the knowledge base article KB0024066, which requires permissions to access. Follow exactly what the manufacturer states; the material does not specify which version resolves the issue, so do not assume a fixed release number.
Look for signs of intrusion. Because the flaw allows file operations on the appliance, review logs and file integrity on the device, and check for unexpected changes or activity around the period of exposure.
Reduce what is exposed to the internet. Restrict access to the appliance to the networks and users that genuinely need it, and review whether it must be reachable from anywhere at all.
Keep the evidence. If you suspect compromise, preserve logs before rebooting or rebuilding, as they may be needed for a GDPR-related assessment of whether personal data was affected.

How a cybersecurity team such as ALMC's can help

Situations like this one are exactly where a small IT team runs out of hands. At ALMC we work with SMEs and online shops across Catalonia on security audits and pentesting to find weaknesses before someone else does, server hardening to cut down the surface an attacker can reach, and monitoring and incident response when something looks wrong. We also handle maintenance and updating of WordPress, PrestaShop and Joomla sites, and repair websites that have already been hacked.

In a case like CVE-2026-102764, that means helping you locate every instance of the product, interpret the manufacturer's advisory correctly, apply the mitigation in a controlled way and check afterwards whether anything was touched. It is unglamorous work, but it is the difference between reading about a critical vulnerability and living through one.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.