Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
Affects BeyondTrust Remote Support versions 0 through 26.2.3. The patch covers 24.3.1 to 26.2.3, and releases older than 24.3.1 must be upgraded before the patch can be applied.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 24.3.1 to 26.2.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 proofs of concept on GitHub
- Exploitation: active
- Automatable: yes
- Technical impact: total
Summary
The vulnerability affects the internal messaging components of BeyondTrust Remote Support, a remote access product. An attacker could potentially use it to perform unauthorized file operations on the appliance.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: total
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- BeyondTrust Remote Support
through 26.2.3
References 6
nvd.nist.gov
beyondtrust.com
beyondtrustcorp.service-now.com
GitHub · CompleTech-Security/beyondtrust-remote-support-cve-2026-102764-check
GitHub · Worthes/CVE-2026-102764-Proof-of-concept
GitHub · maxprog-svg/CVE-2026-102764
Questions about CVE-2026-102764
What does this mean?
The internal messaging components of BeyondTrust Remote Support do not properly validate the origin of messages. The advisory title names this as improper origin validation.Source: github.com
Am I affected, and how do I check?
Remote Support versions 0 through 26.2.3 are listed as affected. To check a installation, a reader can compare the installed Remote Support version against that range.Source: github.com
What should I do about it?
Apply the patch for the 24.3.1 to 26.2.3 versions. Releases older than 24.3.1 must be upgraded before the patch can be applied.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-16, which means it has evidence of attacks. Public exploit code exists (a proof of concept on GitHub).Source: cisa.gov, cve.now feed data