BeyondTrust Remote Support file write exploited (CVE-2026-102764)

Actively exploited in the wild - CVE-2026-102764 is a critical origin-validation flaw in BeyondTrust Remote Support that lets an unauthenticated network attacker perform file operations on the appliance. CISA added it to the Known Exploited Vulnerabilities catalog, confirming real-world attacks; apply BeyondTrust’s patch immediately.

Overview

Internally, Remote Support components exchange messages to coordinate sessions, file transfers, and appliance management. The code that handles those messages did not verify where a message actually came from. An attacker who can reach the affected interface can send crafted messages that the appliance treats as legitimate, then use that trust to carry out file operations on the system.

The defect is tracked as CVE-2026-102764 with a CVSS score of 9.3, rated critical. The vector (network, low complexity, no privileges, no user interaction) means exploitation requires only reachability, not credentials or a victim clicking anything. That combination is what makes this attractive to attackers and why CISA’s KEV listing matters.

Impact

Because the flaw allows file operations on the appliance, an attacker can potentially read, modify, or plant files. On a remote-support appliance that is significant: these systems sit inside the network and hold session data, configuration, and often credentials or trust relationships with other systems. File write access can become a stepping stone to persistence, tampering, or broader lateral movement. The EPSS score is currently 0.6%, indicating low predicted mass-exploitation volume over the next 30 days, but KEV status means confirmed attacks are already happening.

Remediation and Mitigation

• Apply the vendor patch. BeyondTrust has published guidance for CVE-2026-102764; check the official advisory for the fixed build for your deployment.
• If you cannot patch immediately, restrict network access to the appliance’s management and message interfaces to trusted hosts only.
• Review appliance logs for unexpected file operations or anomalous message traffic.
• Rotate credentials and secrets stored on or accessible from the appliance if you suspect compromise.
• Monitor vendor and CISA feeds for updates, and follow security news for follow-on reporting. If a compromise is confirmed, check breach reports for context on similar incidents.

Security Insight

Remote-support and remote-monitoring tools have become a preferred initial-access target precisely because they hold privileged, always-on positions inside victim networks. This CVE echoes the pattern seen with edge appliances and management planes: a trust assumption inside internal messaging becomes an unauthenticated entry point once an attacker can reach it. That the flaw was exploited before broad public awareness underlines why appliance inventory and rapid patching of internet-exposed management interfaces remain a top defensive priority.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs