BeyondTrust Remote Support Auth Bypass Hits CISA KEV

CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16. The federal patch deadline is October 19. That’s today.

The flaw is a CVSS 9.8 authentication bypass in BeyondTrust Remote Support (RS), the platform enterprises use for remote endpoint access and help-desk workflows. According to BeyondTrust’s October 15 disclosure and Rapid7’s emergency threat response write-up, an unauthenticated remote attacker can exploit the bypass to perform file operations directly on the appliance. NVD confirms the CVSS 9.8 critical rating.

Patch now

Apply BeyondTrust’s fix per their security advisory. The combination of unauthenticated access, file operations on the appliance, and confirmed active exploitation makes this worth bumping past your normal patch queue.

Federal agencies are already under CISA BOD 26-04 deadline as of today. For everyone else: KEV listing plus confirmed exploitation is enough reason to prioritize this over routine update cycles.

If patching right now isn’t possible, assess whether the RS appliance has direct internet exposure and review the forensic triage requirements CISA references in the KEV entry. Unauthenticated file access on a remote support appliance is not a vulnerability to sit on.

BeyondTrust issued patches for four RS and Privileged Remote Access flaws back in July. See that earlier coverage for context on the product’s recent patch history.

Full CVE details are at CVE-2026-102764.