CriticalCVE-2026-102764

    Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support (CVE-2026-102764)

    Published Last modified In CISA KEV since Sources: CVE.org, BSI

    What is affected, what to do

    The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received.

    The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • BeyondTrust Remote Support lte *..26.2.3

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: CVE.org, BSI

    1.2 %

    EPSS score

    Moderate — model estimates 1-10% exploitation likelihood.

    Source: FIRST EPSS, percentile 67.2

    Show all metrics
    Severity
    Critical
    Priority score

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    215.11
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited (KEV)Source: VulnCheck KEV (opens in a new tab)
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    CVSS v4

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.3
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    1.2 %
    Moderate — model estimates 1-10% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    67.2
    High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-290

    Response and mitigation

    Why act now?

    Prioritisation rationale

    The flaw is network-reachable without authentication or user interaction. It sits in a product whose whole purpose is brokering privileged remote access into many internal systems, so the blast radius extends well beyond the appliance itself. The modelled exploitation likelihood is only moderate and CISA records no ransomware use, but KEV listing confirms real-world attacks. Remote-support platforms are a favoured initial-access and supply-chain vector against MSPs and critical-infrastructure operators. Treat internet-exposed on-prem appliances as critical and fix them immediately. Internal-only appliances, or SaaS instances with confirmed vendor patching, remain high priority but can be scheduled within days.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Inventory and patch: Identify every BeyondTrust Remote Support appliance (physical, virtual, SaaS) and check its version under /appliance. Version 26.2.3 is listed as affected. A patch is available from the vendor — look up the fixed version in the vendor advisory. Apply the hotfix or update via the BeyondTrust updater without delay.
      • SaaS tenants: Get written confirmation from BeyondTrust, or check the customer portal, that hosted instances have been patched. Do not assume automatic remediation; you need the evidence for NIS2 records.
      • Cut exposure: If an on-prem appliance cannot be patched within hours, restrict the web and admin interface (TCP 443) at the perimeter to known technician and customer IP ranges. If necessary, take the appliance offline from the internet until it is patched.
      • Integrity review: Review appliance file and configuration changes since the KEV addition date (2026-10-16). This includes session logs, Jump Client changes, and new or modified user and API accounts.
      • Rotate secrets: File operations on the appliance are possible, so treat everything stored there as potentially exposed. This covers API client secrets, local admin passwords, vault credentials (if Password Safe or a vault is integrated) and SAML/LDAP bind accounts. Rotate them after patching.
      • Reporting: If you find signs of compromise, assess NIS2/national reporting obligations (24 h early warning). Remote-support platforms provide direct paths into operator networks.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: Place the appliance in a dedicated DMZ. Allow outbound traffic only to defined Jump Client networks and vendor update hosts. Default-deny lateral connections from the appliance into core zones such as AD and OT.
      • Upstream access control: Expose /appliance and /login admin paths only via VPN or ZTNA with MFA. Keep public reachability solely for the customer-client path where it is operationally unavoidable.
      • WAF/reverse proxy: Log and block requests to appliance endpoints with anomalous or missing Origin/Host headers, and drop WebSocket upgrades from non-allowlisted sources. This is a heuristic, since the flaw stems from missing origin validation of internal messages.
      • IAM/least privilege: Reduce the privileges of appliance-linked accounts (LDAP bind, Jump Client service accounts). Do not grant domain admin rights to Jump groups, and scope Jump Points to only the targets that need them.
      • Configuration hardening: Disable unused features (public portals, idle API accounts, mass Jump Client deployment). Enable syslog forwarding from the appliance to the SIEM if it is not already in place.

    3. Runbook step 3

      Detection rules

      • Web/proxy logs: Look for requests to appliance endpoints from unknown source IPs, especially WebSocket upgrades that are never followed by an authenticated session. Example (SPL): index=proxy dest=<bt_appliance> http_method=GET upgrade="websocket" NOT src_ip IN (<allowlist>) | stats count by src_ip, uri_path
      • Appliance syslog: Alert on new admin or API accounts, group policy changes, and file uploads or modifications (plugins, branding, installer packages) outside maintenance windows. A suitable Sigma shape is logsource: product=beyondtrust, selecting account-create/config-change events and filtering out known admins.
      • EDR on Jump Client hosts: Watch for process chains where the BeyondTrust client (bomgar-scc.exe or the Jump Client service) spawns cmd.exe, powershell.exe or rundll32.exe with no documented support session. Use Sysmon EID 1 with ParentImage containing bomgar.
      • Windows events: Monitor for new services (EID 7045) and new local users (EID 4720) on Jump Client hosts. Also watch for logons (EID 4624, LogonType 3/10) from the appliance IP outside recorded session times.
      • Network (Zeek/Suricata): Flag outbound connections from the appliance to non-allowlisted external destinations, and unusually large transfers out of the appliance. For example, conn.log with orig_h=<appliance> and resp_bytes above baseline can indicate exfiltration.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

    Source: cvelistv5, NVD (NIST), CISA KEV Catalog, BSI CSAF, BSI WID Portal

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    VendorProductAffected versionsFixed in
    BeyondTrustRemote Support
    • ≤ 26.2.3
    • ≤ 26.2.3
    • —
    • —
    beyondtrustremote_support
    • ≤ 26.2.3
    • —

    Weakness classes (CWE)

    • CWE-290Authentication Bypass by Spoofing

      Base

      This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

      Entry at MITRE CWE-290

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    SourceReferenceMaturityPublished
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited (KEV)
    PoC-in-GitHub (nomi-sec)CVE-2026-102764-Proof-of-concept (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    Reanalysis & status changes

    Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

    1. CVE Modified134c704f-9b21-4f2e-91b3-4a467353bcc0

      • SSVC: before {"id":"CVE-2026-102764","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"techni…
      • SSVC: after {"id":"CVE-2026-102764","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"techni…

    2. Initial Analysisnvd@nist.gov

      • CVSS V3.1: after AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
      • CPE Configuration: after OR *cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:* versions up to (including) 26.2.3
      • Reference Type: after BeyondTrust: https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066 Types: Permissions Required
      • Reference Type: after BeyondTrust: https://nvd.nist.gov/vuln/detail/CVE-2026-102764 Types: US Government Resource

    3. CVE CISA KEV Update9119a7d8-5eab-497f-8521-727c672e3725

      • Date Added: after 2026-10-16
      • Due Date: after 2026-10-16
      • Required Action: after 2026-10-16
      • Vulnerability Name: after 2026-10-16

    4. CVE Modified134c704f-9b21-4f2e-91b3-4a467353bcc0

      • Reference: after https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764
      • SSVC: after {"id":"CVE-2026-102764","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"techni…

    5. New CVE Received13061848-ea10-403d-bd75-c83a022c2891

      • Description: after The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
      • CVSS V4.0: after AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
      • CWE: after CWE-290
      • Affected: after New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/102xxx/CVE-2026-102764.json">CVE-2026-102764</a>

    Linked advisories