Active Exploitation of BeyondTrust Remote Support Vulnerability (CVE-2026-102764)
Successful exploitation of CVE-2026-102764 could allow a remote, unauthenticated attacker to upload arbitrary files on affected appliances
Summary
Successful exploitation of CVE-2026-102764 could allow a remote, unauthenticated attacker to upload arbitrary files on affected appliances
Affected platforms
The following platforms are known to be affected:
Threat details
Exploitation of CVE-2026-102764
Security researchers have stated that they have observed exploitation of CVE-2026-102764 in the wild involving custom malware and webshells.
The NHS England National CSOC assesses further exploitation as highly likely.
Organisations are strongly encouraged to follow NCSC's vulnerability management guidance, including implementing a "patch by default" policy and patching edge devices as soon as possible if a critical vulnerability is identified.
Introduction
BeyondTrust has published a security advisory addressing a vulnerability in Remote Support (RS). Successful exploitation of CVE-2026-102764 could allow a remote, unauthenticated attacker to upload arbitrary files on affected systems.
- CVE-2026-102764 - 'Authentication bypass by spoofing' vulnerability - CVSSv4 score: 9.3.
Note: BeyondTrust has advised that Privileged Remote Access products may also be affected by CVE-2026-102764.
Remediation advice
Affected organisations must review BeyondTrust security advisory BT26-05 and apply the remediation steps detailed below.
Note: BeyondTrust has advised that Privileged Remote Access products may also be affected by CVE-2026-102764.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Required: Upgrade to a fixed version Affected organisations must apply the patch detailed in BT-26-05 to affected BeyondTrust Remote Support and Privileged Remote Access appliances. https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 |
Definitive source of threat updates
Last edited: 16 October 2026 12:07 pm