BeyondTrust Remote Support Authentication Bypass Vulnerability (CISA KEV Alert)

Summary: CISA is warning about an actively exploited authentication bypass vulnerability (CVE-2026-102764) in BeyondTrust Remote Support. This flaw could allow a remote attacker to perform file operations on the appliance.

This CISA KEV (Known Exploited Vulnerabilities) alert announces a critical authentication bypass vulnerability (CVE-2026-102764) in the BeyondTrust Remote Support product. Such vulnerabilities allow attackers to gain access to a system without valid credentials. CISA’s designation of this flaw as “actively exploited” indicates a high level of risk.

The vulnerability relies on bypassing authentication through “spoofing.” This means an attacker can impersonate a legitimate user or system to circumvent security controls. As a result, a remote attacker could perform file operations on the BeyondTrust Remote Support appliance, posing a risk of data exfiltration or system manipulation.

For live systems and operations, this situation is an urgent security priority for all organizations using BeyondTrust Remote Support. Since this product is often used to provide remote access to critical infrastructure components, exploitation of the vulnerability could have severe consequences. Administrators must promptly apply relevant patches and keep their systems updated.

Infrastructure teams should regularly check the CISA KEV catalog and prioritize “actively exploited” vulnerabilities in products used within their own infrastructures. Such alerts indicate the most critical security issues requiring immediate action.

🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar