# BeyondTrust Remote Support zero-day exploited

Published: 2026-10-16 · Severity: severe · Sectors: technology
Canonical: https://vorant.io/reports/cd7ab90d-338e-5f04-8fb6-32b2224afad2/beyondtrust-remote-support-zero-day-exploited

> A critical authentication bypass in BeyondTrust Remote Support (CVE-2026-102764) is being actively exploited as a zero-day to plant or modify files on appliances.

NCSC-NL issued a high-priority advisory for a critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS v4 score of 9.3. The flaw stems from insufficient validation of message origin within internal product components, allowing an unauthenticated attacker to remotely place or modify files on an affected appliance. All Remote Support versions up to and including 26.2.3 are affected.

BeyondTrust has confirmed that CVE-2026-102764 has been exploited in the wild as a zero-day, meaning active exploitation occurred prior to patch availability. BeyondTrust released patch BT26-05-RS for Remote Support versions 24.3.1 through 26.2.3 to remediate the vulnerability. Organizations running older self-hosted versions must first upgrade to a supported version before applying the patch.

NCSC-NL advises applying the security update urgently and investigating potentially vulnerable systems for indicators of prior compromise, given the confirmed in-the-wild exploitation. Defenders using BeyondTrust Remote Support should prioritize patching and review appliance logs and file integrity for signs of unauthorized file placement or modification predating the patch.

## Mentioned in this report

- Vulnerabilities: CVE-2026-102764 (KEV)

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0437.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cd7ab90d-338e-5f04-8fb6-32b2224afad2/beyondtrust-remote-support-zero-day-exploited.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup