CISA Adds Exploited BeyondTrust Remote Support Flaw to KEV
Tech GuruQuick Answer
CISA added BeyondTrust Remote Support CVE-2026-102764 to KEV on October 16, confirming known exploitation. BeyondTrust rates the flaw Critical at CVSS 9.3 and lists Remote Support 26.2.3 and earlier as affected. Inventory appliances, preserve evidence, apply the BT26-05-RS patch or upgrade older releases, complete required forensic triage by October 19 where applicable, validate service behavior, and retain proof.
Patch Remote Support And Complete Forensic Triage
What to do now: Inventory Remote Support appliances and update state, preserve appliance and identity evidence, apply the vendor patch or upgrade unsupported older releases, complete the CISA-required forensic triage, validate remote-support workflows, and document the October 19 disposition where applicable.
Last verified: 2026-10-17 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | BeyondTrust Remote Support appliances |
|---|---|
| Advisory | BT26-05 / CISA KEV: CVE-2026-102764 |
| CVE | CVE-2026-102764 |
| Authoritative release date | 2026-10-16 (CISA KEV addition; BeyondTrust issued BT26-05 on 2026-10-15) |
| Authority revision date | 2026-10-16 17:15:48.8752 UTC (CISA KEV catalog release); BeyondTrust lists BT26-05 updated on 2026-10-15 |
| Affected versions | BeyondTrust Remote Support 26.2.3 and earlier; the vendor advisory states that Remote Support SaaS was patched on October 9, 2026 |
| Fixed version | the BT26-05-RS patch for Remote Support 24.3.1 through 26.2.3; self-hosted releases older than 24.3.1 must first upgrade to a supported newer release |
| CVSS base score | 9.3 (official CVSS v4.0 base) |
| CVSS severity | Critical |
| Exploitation status | Known exploited: confirmed by CISA KEV; ransomware campaign use is Unknown; no exploitation claim is inferred. |
What Changed
BeyondTrust describes improper origin validation in an internal Remote Support messaging component that can let a remote attacker perform file operations on an affected appliance. CISA added CVE-2026-102764 to KEV, confirming known exploitation and requiring forensic triage under the applicable BOD 26-04 process.
What To Validate Now
- Inventory. Record deployment model, exact Remote Support release, appliance role, internet exposure, automatic-update state, administrative access paths, patch status, owner, backups, and recovery dependencies.
- Establish applicability. Match each Remote Support appliance to BT26-05. Remote Support 26.2.3 and earlier is affected; SaaS was patched by BeyondTrust on October 9. Do not infer that an appliance was exploited merely because its release is affected.
- Remediate. For self-hosted Remote Support 24.3.1 through 26.2.3, apply the BT26-05-RS patch using the appliance interface. Upgrade releases older than 24.3.1 before applying the patch. Verify SaaS tenant status through the vendor rather than attempting an appliance patch.
- Validate. Confirm the resulting release and patch status, test authentication, session brokering, file operations, recording, logging, integrations, high availability, and recovery. Complete forensic triage and review relevant appliance, identity, network, and administrative evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve evidence before remediation, coordinate maintenance for remote-support dependencies, and maintain a tested rollback path. CISA lists ransomware use as Unknown; known exploitation does not establish compromise of a particular appliance. The BT26-05 advisory's affected-product statement controls scope.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
