CVE-2026-102764

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 17, 2026

Description

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
BeyondTrust	Remote Support	<= 26.2.3

References

https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066Permissions Required
https://nvd.nist.gov/vuln/detail/CVE-2026-102764US Government Resource
https://www.beyondtrust.com/blog/entry/bt26-05Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764US Government Resource

Timeline

Published: Oct 15, 2026
Last modified: Oct 17, 2026
Added to CISA KEV: Oct 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-102776.3A vulnerability was found in j3k0 mcp-google-workspace up to 831790e7d5c2663325733d9f5579cc339a267c4c. This issue affects the function saveT CVE-2026-1027714.7A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templateP CVE-2026-1027727.2The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g. kl_code, kl_post_code)' p CVE-2026-1027746.4The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'CVE-2026-1027757.5Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart CVE-2026-1027764.3Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks CVE-2026-1027776.5Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google P CVE-2026-1027786.1Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The pa CVE-2026-1027797.3Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extensio CVE-2026-102786.3A vulnerability was determined in ishayoyo excel-mcp up to 1.0.2. Impacted is an unknown function of the file src/index.ts of the component CVE-2026-1027809.8Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension CVE-2026-1027816.9Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wir