CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalogue on 16 October 2026. The flaw affects BeyondTrust Remote Support and is an authentication bypass by spoofing that could let a remote attacker perform file operations on the appliance.
The vulnerability allows an attacker to bypass authentication through spoofing, with remote access to file operations as the stated impact. It has a CVSS score of 9.3, rated Critical. Patch status is unknown; BeyondTrust’s security advisory is listed in the KEV entry, but no patch information was provided in the available data.
KEV inclusion means CISA has confirmed that the vulnerability is being actively exploited. Use in ransomware campaigns is unknown. CISA set 19 October 2026 as the remediation deadline.
CISA requires agencies to apply mitigations in accordance with vendor instructions and comply with BOD 26-04 and its Forensics Triage Requirements. For cloud services, agencies should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching guidelines.
Federal Civilian Executive Branch (FCEB) agencies are directly subject to CISA’s remediation requirements; all organisations should review their exposure and consult the vendor’s security advisory.
For full details, see the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-102764) and [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).