What happened
CISA added CVE-2026-102764 to KEV on 2026-10-16 (federal due date 2026-10-19) with confirmed in-the-wild exploitation. The flaw is an improper-origin-validation weakness in an internal messaging component of Remote Support that lets an unauthenticated remote attacker perform file operations on the appliance; CVSS 9.3. Primary advisory verified (issue date 10/15/2026); BeyondTrust applied the fix to SaaS on Oct 9 and shipped BT26-05-RS for self-hosted.
Why it matters
Remote support appliances are the classic trojan-horse entry point into enterprise networks: a full-appliance compromise yields remote-control capabilities over technicians' and users' machines, the exact foothold attackers use to reach the networks, data stores, and credentials that host AI/agent workloads. BeyondTrust explicitly positions its Identity/Security platform around AI agent credentials, making this remotely-exploitable, actively-exploited remote-access bypass an operational urgency item for any organization running AI workloads behind a BeyondTrust remote-support deployment — treat as a priority given confirmed in-the-wild use.
Attack vector
Improper origin validation (CWE-290) in an internal messaging component of Remote Support: an unauthenticated remote attacker sends crafted messages with spoofed origins, enabling file operations on the appliance. Requires network reach to the Remote Support appliance/service.
Affected systems
BeyondTrust Remote Support (RS) all versions ≤ 26.2.3 (SaaS patched Oct 9; self-hosted patch for v24.3.1–26.2.3; older than 24.3.1 requires upgrade)
Mitigation
SaaS: patch already applied (Oct 9, 2026) by BeyondTrust. Self-hosted: apply BT26-05-RS patch for v24.3.1–26.2.3; upgrade versions older than 24.3.1 before patching. See https://www.beyondtrust.com/trust-center/security-advisories/bt26-05