Vulnerabilities · 3h ago

BeyondTrust Remote Support zero-day hit hosted and self-hosted systems

BeyondTrust confirmed on August 29, 2026, that CVE-2026-102764 was being exploited as a zero-day against one hosted and one self-hosted Remote Support instance. In an October 16 update, it said it knew of no attacker activity after August.

The flaw let messages reach internal components without adequate checks on where they came from. A remote attacker could use messages that should not be trusted to make an affected device perform file operations.

BeyondTrust patched its Remote Support SaaS customers on October 9; self-hosted deployments remain separate from that fix. The vendor also recommends a precautionary patch for Privileged Remote Access (PRA), which shares code, but says its testing found no way to exploit the flaw there. The confirmed exposure is Remote Support—not evidence of a second compromised product.

CVE-2026-102764

NVD KEV

Published Oct 15 by BeyondTrust

Known exploited · CISA KEV

CISA federal remediation date Oct 19

Timeline

Oct 19 Reported by INCIBE-CERT
Oct 16 CVE-2026-102764 added to CISA KEV
Oct 15 CVE-2026-102764 published

Sources

1 source covering this story

INCIBE-CERT Oct 19
Validación incorrecta del origen en Remote Support de BeyondTrust
BeyondTrust ha publicado una vulnerabilidad crítica que podría permitir a un atacante remoto no autent

Entities

CVE-2026-102764

Part of the PlainSec briefing for 2026-10-19

Editions

Briefing for 2026-10-19

Vulnerabilities · 3h agoBeyondTrust Remote Support zero-day hit hosted and self-hosted systemsBeyondTrust confirmed on August 29, 2026, that CVE-2026-102764 was being exploited as a zero-day against one hosted and one self-hosted Remote Support instance. In an October 16 update, it said it knew of no attacker activity after August.The flaw let messages reach internal components without adequate checks on where they came from. A remote attacker could use messages that should not be trusted to make an affected device perform file operations.BeyondTrust patched its Remote Support SaaS customers on October 9; self-hosted deployments remain separate from that fix. The vendor also recommends a precautionary patch for Privileged Remote Access (PRA), which shares code, but says its testing found no way to exploit the flaw there. The confirmed exposure is Remote Support—not evidence of a second compromised product.