AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764

This Alert is intended for IT professionals and managers.

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting BeyondTrust Remote Support (RS)Footnote 1Footnote 2. In response to the vendor advisory released on October 15, 2026, the Cyber Centre released AV26-1054 on October 16, 2026Footnote 3.

Tracked as CVE-2026-102764Footnote 4, this vulnerability is an Authentication Bypass by Spoofing vulnerability (CWE-290)Footnote 5 that affects all versions of BeyondTrust Remote Support.

Successful exploitation of this vulnerability may allow a remote, unauthenticated attacker to exploit insufficient origin validation in internal BeyondTrust Remote Support messaging components to perform unauthorized file operations on an affected appliance without user interaction. The vulnerability requires no credentials or user action and can enable arbitrary file uploads, potentially resulting in full compromise of the appliance.

The Cyber Centre has observed open-source reporting indicating that the vulnerability is being exploited in the wildFootnote 6.

The Cyber Centre strongly recommends that organizations running affected BeyondTrust Remote Support deployments upgrade to the following fixed version:

BeyondTrust has confirmed that a patch addressing this vulnerability was applied to all Remote Support SaaS and Privileged Remote Access SaaS customers as of 9 October 2026. Organizations using these SaaS offerings do not need to take any additional action to remediate this issue.

The Cyber Centre also recommends organizations to: