CVE-2026-102764
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Added: 2026-10-16 · Due: 2026-10-19
Known ransomware use: Unknown
As of 2026-10-27
EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.
CWE: CWE-290 · Published: 2026-10-15T21:17:00.117 · Modified: 2026-10-17T04:16:47.117
Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.
All CVSS assessments
- CVSS 4.0: 9.3 (CRITICAL) · 13061848-ea10-403d-bd75-c83a022c2891
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1: 9.8 (CRITICAL) · NIST NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H