BeyondTrust Remote Support zero-day exploited
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
A critical authentication bypass in BeyondTrust Remote Support (CVE-2026-102764) is being actively exploited as a zero-day to plant or modify files on appliances.
NCSC-NL issued a high-priority advisory for a critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS v4 score of 9.3. The flaw stems from insufficient validation of message origin within internal product components, allowing an unauthenticated attacker to remotely place or modify files on an affected appliance. All Remote Support versions up to and including 26.2.3 are affected.
BeyondTrust has confirmed that CVE-2026-102764 has been exploited in the wild as a zero-day, meaning active exploitation occurred prior to patch availability. BeyondTrust released patch BT26-05-RS for Remote Support versions 24.3.1 through 26.2.3 to remediate the vulnerability. Organizations running older self-hosted versions must first upgrade to a supported version before applying the patch.
NCSC-NL advises applying the security update urgently and investigating potentially vulnerable systems for indicators of prior compromise, given the confirmed in-the-wild exploitation. Defenders using BeyondTrust Remote Support should prioritize patching and review appliance logs and file integrity for signs of unauthorized file placement or modification predating the patch.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0437.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs