What is CVE-2026-102764?

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

CISA added this issue to its exploited-vulnerability catalog on 2026-10-16. This is the catalog date, not this article’s publication date.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-102764 — NVD, CVE-2026-102764 — CVE Program record

First, confirm where the vulnerable product is running

CVE-2026-102764 is an authentication bypass via improper origin validation in BeyondTrust Remote Support internal messaging components, allowing remote file operations on the appliance. The CISA KEV entry mandates applying vendor mitigations per BOD 26-04 and forensics triage requirements. Fixed versions are not established by the supplied catalog entry; verify in the linked BeyondTrust advisory (KB0024066). Cloud deployment support and managed service exposure are not established—do not assume marketplace images, Kubernetes deployments, or impact on other managed services. This is a vendor appliance vulnerability; remediation follows the vendor-supported upgrade path, not host OS patching or agent installation.

The named vulnerable product is BeyondTrust Remote Support. Deployment on a cloud platform does not by itself establish that a managed AWS, Azure or GCP service is vulnerable. Confirm the product, version, vendor-supported deployment and remediation owner.

Vendor remediation comes first

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Use the current vendor advisory for affected versions and fixed builds. This catalog entry does not establish a universal fixed version or a cloud-specific hotfix.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-102764 — NVD

AWS: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Inventory customer-managed BeyondTrust Remote Support appliances on EC2; confirm internet exposure and network segmentation.
  2. Do not use Systems Manager Patch Manager for this appliance—it orchestrates OS/application packages, not vendor appliance firmware. Follow BeyondTrust’s upgrade procedure.
  3. If running Remote Support components in containers on ECS/EKS, verify the vendor-supported container image and replace deployments; do not patch the base OS expecting appliance fixes.
  4. Check AWS Marketplace for a vendor-published updated AMI; applicability is not established by sources.

Sources: AWS Systems Manager Patch Manager

Azure: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. List customer-managed BeyondTrust Remote Support appliances on Azure VMs or Arc-connected servers; assess public accessibility.
  2. Azure Update Manager handles OS updates for Windows/Linux VMs—it does not patch vendor appliances. Apply BeyondTrust’s appliance upgrade per vendor instructions.
  3. For any containerized Remote Support workloads on AKS, confirm the vendor-supported image tag and redeploy; do not assume a managed service is affected without evidence.
  4. Review Azure Marketplace for a vendor-supplied updated image; support is not established by sources.

Sources: Azure Update Manager overview

GCP: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Identify customer-managed BeyondTrust Remote Support appliances on Compute Engine; evaluate external IP exposure and firewall rules.
  2. VM Manager Patch applies OS-level updates via package repositories—it is not a universal appliance updater. Use BeyondTrust’s supported upgrade path.
  3. If Remote Support runs in GKE, verify the vendor-supported container artifact and replace pods; do not claim a managed service is affected without evidence.
  4. Check GCP Marketplace for a vendor-published updated image; applicability is not established by sources.

Sources: Google Cloud VM Manager — About Patch

How to verify the fix

  1. Confirm the appliance reports the mitigated version per BeyondTrust’s advisory (KB0024066); fixed version not established by supplied sources.
  2. Validate that internal messaging origin validation is enforced—review appliance logs for blocked spoofed message attempts.
  3. Verify file operation APIs reject unauthenticated requests from untrusted origins via controlled test from a segmented network.
  4. Ensure forensics triage data (logs, config backups) is preserved per CISA requirements before and after upgrade.

Questions teams ask

What is the fixed version for BeyondTrust Remote Support?

Not established by the supplied catalog entry. Verify in the BeyondTrust advisory (KB0024066) or vendor release notes.

Can I use AWS Systems Manager Patch Manager / Azure Update Manager / GCP VM Manager Patch to fix this?

No. These tools manage OS and supported application packages, not vendor appliance firmware or proprietary application updates. Follow BeyondTrust’s appliance upgrade procedure.

Is my managed cloud service (e.g., AWS Managed Services, Azure Virtual Desktop, Google Cloud Managed Service) affected?

Applicability is not established by the supplied sources. Do not assume affected or unaffected status for another product; contact the service provider.

Does applying the vendor upgrade guarantee no prior compromise?

A patch does not prove there was no earlier compromise. Perform forensics triage per CISA guidance and review appliance logs for anomalous file operations before the upgrade.

Sources & further reading

This brief summarizes public source material. Confirm affected versions and the current vendor instructions before changing production. No original exploit validation is claimed.