1. Executive summary
CVE-2026-102764 is an authentication bypass by spoofing vulnerability in BeyondTrust Remote Support (CVSS 9.3, critical, CWE-290) that could allow a remote attacker to perform file operations on the appliance. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16, with a remediation due date of 2026-10-19, three days from issuance. EPSS sits at 1%, so the KEV listing, not exploit-probability modelling, is the reason this is urgent. Remote Support is a privileged remote-access appliance, and EMEA financial services firms commonly expose it to the internet for vendor and helpdesk access, which puts it in the class of edge device that gets targeted first. Treat any internet-facing instance as compromised until you have evidence otherwise.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17: ICT-related incident management process | CISA KEV listing on 2026-10-16 with a 2026-10-19 remediation due date, and the possibility of unauthorised file operations on a privileged access appliance | The three-day window forces the incident-management process to run at detection speed: triage, containment decision and evidence capture must be executable inside 72 hours, not scheduled into the next change window |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | A KEV-listed authentication bypass on an appliance that brokers privileged access to production systems | If exploitation is confirmed or cannot be excluded, the classification and reporting clock starts at detection, so log retention and the decision trail for this CVE need to be preserved now |
| NIS2 Art. 23: incident reporting obligations | Same trigger: confirmed or suspected exploitation of an internet-facing access appliance | Entities in scope must be able to produce an initial notification on the regulatory timeline; the KEV due date does not extend it |
DORA Art. 18 is not cited separately because classification is the input to the Art. 19 obligation above, not a distinct action here. No third-party or concentration article is engaged by the facts in this item.
3. Technical analysis & attack chain
The verified data classifies CVE-2026-102764 as CWE-290, authentication bypass by spoofing, CVSS 9.3, and states the outcome as file operations on the appliance performed by a remote attacker. CISA added it to KEV on 2026-10-16. The NVD entry does not describe the spoofed element, the affected versions, or the file operations in detail, and no vendor advisory with a fixed version is present in the material supplied for this item.
Confirmed steps, at the level the sources support:
- The attacker reaches the BeyondTrust Remote Support appliance remotely. No authentication is required for the bypass itself.
- The attacker spoofs an identity or trust element that the appliance accepts, satisfying its authentication check (CWE-290).
- With the check satisfied, the attacker performs file operations on the appliance.
That is the whole of the confirmed chain. Everything past step 3, including whether file operations lead to code execution, credential access, or lateral movement into managed endpoints, is not stated in the sources and should not be assumed.
Two related items in the corpus describe the same product family and are worth separating from this CVE. The Hacker News and BleepingComputer coverage describes CVE-2026-40138 (CVSS 9.2), a pre-authentication flaw in Remote Support and Privileged Remote Access, and a GitHub advisory describes a high-severity pre-authentication vulnerability in the network communication subsystem where insufficient validation of client-supplied input allows an unauthenticated remote attacker to cause a denial of service affecting appliance availability. Neither of those is CVE-2026-102764, and neither source names this CVE. Do not merge them: the DoS advisory is a different weakness class (availability, not authentication bypass), and the CVSS 9.2 figure belongs to CVE-2026-40138.
The corpus also contains KEV entries for unrelated products, CVE-2026-48558 (SimpleHelp, OIDC token signature not verified, forged token yields an authenticated technician session, MFA bypass in some configurations) and CVE-2026-104935 (Ivanti Connect Secure, authentication bypass by spoofing leading to arbitrary command execution). These are context for the pattern of edge-appliance authentication bypass, not indicators for this CVE. The SimpleHelp entry is the closest functional analogue: an unauthenticated attacker obtaining a privileged session on a remote-support platform. If your estate runs SimpleHelp, that entry has its own due date of 2026-07-02 and is separately overdue.
Confidence caveats. The mechanism beyond "spoofing" is single-sourced to the NVD record and is thin. No source in this set confirms in-the-wild exploitation against a named victim, and the KEV entry does not state that exploitation has been observed in ransomware operations; the NVD record lists known ransomware campaign use as unknown. The KEV listing establishes that CISA assesses the vulnerability as exploited, and that is the basis for the urgency here, not any observed campaign detail. No threat actor is named in any source, so there is no attribution to make and none should be inferred.
4. Mitigation & containment
P1, within 24 hours:
- Inventory every BeyondTrust Remote Support instance, on-premises and cloud, and record which are internet-facing. The KEV due date is 2026-10-19; anything reachable from the internet is the priority.
- Apply the vendor mitigation in accordance with BeyondTrust instructions. The NVD record directs this and does not name a fixed version, so obtain the version and patch guidance from BeyondTrust directly rather than from this advisory.
- Where a mitigation is not available, follow the BOD 26-04 guidance for cloud services or discontinue use of the product. For an on-premises appliance with no fix, take it off the internet.
- Restrict management and access interfaces to known source addresses at the perimeter. If the appliance does not need to be internet-facing for business reasons, remove the exposure now and re-expose only after patching.
- Preserve logs before any rebuild. Authentication logs, appliance audit logs, and any file-integrity or EDR telemetry covering the appliance host are the evidence base for the DORA Art. 19 decision.
P2, within 72 hours:
- Hunt for the post-exploitation signature the CVE implies: file operations on the appliance that do not map to a legitimate administrative session. Compare file modification times against the authentication log for the same window.
- Review all sessions established through the appliance since the earliest plausible exposure date, with particular attention to sessions that begin without a corresponding successful interactive login.
- Rotate credentials and secrets that the appliance holds or brokers: local administrative accounts, API keys, and any credentials stored for remote-session brokering. An authentication bypass on an access broker is a credential-exposure event until proven otherwise.
- Confirm whether the appliance is in scope for DORA Art. 24 resilience testing and whether the current test plan would have caught an unauthenticated file-write path. If not, that gap is the finding to escalate.
P3, within 7 days:
- Add the appliance to the asset class that gets patch SLAs measured in days, not quarters. The KEV three-day window is not achievable under a monthly cycle.
- Review DORA Art. 28 and Art. 30 arrangements with BeyondTrust as an ICT third-party provider: does the contract oblige notification of actively exploited vulnerabilities within a timeframe that lets you meet the 2026-10-19 date, and does it give you the technical detail needed to assess exposure?
- If the appliance is one of several remote-access products in the estate, run the concentration check under DORA Art. 29. The corpus shows SimpleHelp and Ivanti Connect Secure carrying KEV authentication bypasses in the same period; a single compromise path across multiple remote-access vendors is a concentration question, not three separate incidents.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources provide no hashes, domains, IP addresses, file paths, or command lines for CVE-2026-102764. The NVD record describes the outcome (file operations on the appliance) without naming files, paths, or accounts. Nothing here is machine-pivotable, and none should be invented.
Behavioural indicators, derived from the CVE description and the KEV listing. These are inference from the stated mechanism, not vendor-published detection content; validate against your own baseline before alerting.
| behaviour | where to observe | confidence |
|---|---|---|
| File operations on the Remote Support appliance with no corresponding authenticated administrative session | Appliance audit log correlated against file-integrity monitoring or host EDR | Medium; follows directly from the CVE description but no source publishes the specific files or paths |
| Successful authentication events that do not match a known account, source address, or session-initiation pattern | Appliance authentication log, SIEM | Medium; CWE-290 spoofing implies a trust element is accepted without proper validation, but the spoofed element is not described in the sources |
| New or modified files on the appliance outside a change window | File-integrity monitoring on the appliance host | Low to medium; the CVE states file operations are possible, not that they are detectable by integrity monitoring on every deployment |
6. Detection
Insufficient indicators to author detection rules.
The sources contain no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, or hard-coded values for CVE-2026-102764. The only artefacts available are the CVE identifier, the product name, and vendor headline phrasing, none of which are artefacts of the threat itself. A rule built on those would detect reporting about the vulnerability rather than exploitation of it.
Detection for this item has to be built locally from the behavioural indicators in §5, using your own baseline of legitimate administrative activity on the appliance. If BeyondTrust publishes detection guidance or indicators alongside the fix, that content is the correct basis for a rule and should be ingested when available.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-102764 | 9.3 Critical | ⚠ KEV 2026-10-16 | 1% | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately… |
7. Sources
- NVD, CVE-2026-102764 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-102764, published 2026-10-15
- CISA Known Exploited Vulnerabilities, CVE-2026-102764 (KEV addition 2026-10-16, remediation due 2026-10-19), referenced via the NVD record above
- The Hacker News, BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA, https://thehackernews.com/2026/07/beyondtrust-patches-critical-auth.html (covers CVE-2026-40138, not this CVE)
- BleepingComputer, BeyondTrust warns of critical flaws in remote access software, https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-flaws-in-remote-access-software/ (covers the same patch cycle, not this CVE)
- GitHub Security Advisories, BeyondTrust Remote Support and Privileged Remote Access pre-authentication DoS, https://github.com/advisories/GHSA-8v46-5p7g-p46j (different weakness class, not this CVE)
- BSI Germany, WID-SEC-2026-4001, BeyondTrust Remote Support, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4001
- CISA Known Exploited Vulnerabilities, CVE-2026-48558 (SimpleHelp), https://nvd.nist.gov/vuln/detail/CVE-2026-48558 (context only)
- CISA Known Exploited Vulnerabilities, CVE-2026-104935 (Ivanti Connect Secure), https://nvd.nist.gov/vuln/detail/CVE-2026-104935 (context only)
8. Adverse Trace position
CVE-2026-102764 is critical at CVSS 9.3 and KEV-listed as of 2026-10-16 with a 2026-10-19 remediation due date, and we assess the client impact as high for any EMEA financial services firm running an internet-facing BeyondTrust Remote Support appliance, because the flaw yields unauthenticated file operations on a system that brokers privileged access. The EPSS score of 1% does not change that assessment; the KEV listing is the operative signal. We hold two caveats: the technical detail beyond the CWE-290 classification is single-sourced to the NVD record and is thin, and no source in this set names a threat actor or confirms a specific victim, so there is no attribution to report. We will obtain the BeyondTrust fixed-version and mitigation guidance, since the NVD record does not name a version, and we will reissue this advisory if the vendor publishes indicators or if exploitation detail emerges. Clients who cannot confirm patch state on an internet-facing instance by 2026-10-19 should contact us to scope a compromise assessment covering the appliance and the credentials it brokers.
Published via PulseTrace — Adverse Trace threat intelligence.