CVE-2026-102764Vulnerability
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
Reported by 15 independent sources · first reported by Google Threat Intelligence · last reported
Last reported 5 days ago
Fix due 19 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 67% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
19 reports, newest first · the exact sentence from each-
19th October – Threat Intelligence Report“BeyondTrust has addressed CVE-2026-102764, a critical authentication bypass vulnerability affecting Remote Support versions 26.2.3 and earlier.”
-
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild“CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild”
-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance.”
-
Validación incorrecta del origen en Remote Support de BeyondTrust“CVE-2026-102764: vulnerabilidad de validación incorrecta del origen en componentes internos de mensajería de Remote Support.”
-
Risky Bulletin: PwnEscape vulnerability lets you escape KVM“[BeyondTrust blog // CVE-2026-102764 // Google]”
-
Bulletin d'actualité CERTFR-2026-ACT-044 (19 octobre 2026)“CVE-2026-102764”
-
U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog“CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability”
-
Prolific Chinese espionage group exploits BeyondTrust zero-day“…se government-backed espionage group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect — CVE-2026-102764 — then showcased multiple tactics to escalate privileges, hop around the compromised network and evade detection.”
-
AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764“AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764”
-
CVE-2026-102764: BeyondTrust Zero-Day Exploited“CVE-2026-102764: BeyondTrust Zero-Day Exploited”
-
BeyondTrust security advisory (AV26-1054)“Open-source reporting indicates that CVE-2026-102764 is being exploited in the wild.”
-
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support“CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier.”
-
CISA Adds Two Known Exploited Vulnerabilities to Catalog“CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability”
-
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day“The exploited flaw, tracked as CVE-2026-102764 (CVSS score of 9.3), is described as an improper validation of message origins that could allow attackers to perform file operations on Remote Support (RS) appliances.”
-
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns“…ivileges and established persistent access to compromised BeyondTrust Remote Support appliances following exploitation of the flaw, CVE-2026-102764, in August 2026.”
-
NCSC-2026-0437 [1.00] [H/H] Kwetsbaarheid verholpen in BeyondTrust Remote Support“De kwetsbaarheid met kenmerk CVE-2026-102764 heeft een CVSS-score van 9.3 en betreft onvoldoende validatie van de herkomst van berichten binnen de interne componenten van het product.”
-
Omisión de autenticación mediante suplantación en Remote Support de BeyondTrust“CVE-2026-102764: vulnerabilidad de validación incorrecta del origen en un componente interno de mensajería de Remote Support.”
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers“The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance.”
-
ARMORY CASTLE Exploits BeyondTrust“On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances.”
Indicators reported together
named in the same reports- dc14e215269a93fd…96a6f2ae95fbin 3 reports
- 1f19b9a27d79c11b…d0307e3aa462in 3 reports
Copy these 2 indicators · defanged
Also named with it: CVE-2024-21887, CVE-2023-46805, CVE-2026-97229, CVE-2026-104935, CVE-2026-96951, CVE-2025-61624, CVE-2023-4966, CVE-2025-0282, CVE-2026-76519, CVE-2026-0322, CVE-2026-99999, CVE-2026-22769, CVE-2025-8088, CVE-2026-1731, CVE-2026-34073, CVE-2021-36260, CVE-2026-83498, CVE-2026-74580
Thanks — we review every report.