Authentication Bypass by Spoofing in Remote Support - CVE-2026-102764
Published: October 16, 2026
Vulnerability identifier: #VU156082
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102764
CWE-ID: CWE-290
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to perform unauthorized file operations on an affected BeyondTrust Remote Support appliance.
The vulnerability exists due to improper validation of message origins in the internal messaging components of BeyondTrust Remote Support when processing incoming messages. A remote attacker can spoof the origin of messages to perform unauthorized file operations on the appliance.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Remote Support
How to mitigate CVE-2026-102764
Install security update from vendor's website.
Remote Support - update to BT26-05-RS