CISA KEV Alert: Authentication Bypass Flaw in BeyondTrust Remote Support Actively Exploited
CISA has added a new authentication bypass vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764, to its Known Exploited Vulnerabilities (KEV) catalog. Per BeyondTrust's advisory (BT26-05), the flaw allows a remote attacker to bypass authentication by spoofing, enabling file operations on the affected appliance. No CVSS score has been published yet, and it is unclear whether the vulnerability has been tied to any known ransomware campaigns.
Why It Matters
BeyondTrust Remote Support is widely deployed for privileged remote-access and helpdesk operations, meaning appliances often sit at a trust boundary with elevated access to internal systems. An authentication bypass that permits unauthenticated file operations is particularly concerning on this class of product — remote support tools are a common pivot point for attackers seeking to establish persistence or stage further intrusion. KEV inclusion confirms active exploitation is occurring in the wild, raising urgency for any organization running the affected product.
What Defenders Should Watch For
- Identify all internet-facing or externally reachable BeyondTrust Remote Support appliances in your environment and confirm patch/version status against the vendor advisory.
- Review appliance and application logs for unexpected authentication events, anomalous file read/write/delete activity, or access patterns inconsistent with normal support-session behavior.
- Monitor for unusual outbound connections or new files/scripts appearing on Remote Support appliances that could indicate post-exploitation activity.
- Apply vendor guidance and any available mitigations immediately, and treat internet exposure of this appliance as a priority remediation item until patched.
This is developing intelligence based on a same-day CISA KEV addition; details on exploitation scope and technical specifics may evolve. For authoritative guidance, see BeyondTrust's advisory BT26-05.