AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764

This Alert is intended for IT professionals and managers. An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting BeyondTrust Remote Support (RS)Footnote 1Footnote 2. In response to the vendor advisory released on October 15, 2026, the Cyber Centre released AV26-1054 on October 16, 2026Footnote 3. Tracked as CVE-2026-102764Footnote 4, this vulnerability is an Authentication Bypass by Spoofing vulnerability (CWE-290)Footnote 5 that affects all versions of BeyondTrust Remote Support. Successful exploitation of this vulnerability may allow a remote, unauthenticated attacker to exploit insufficient origin validation in internal BeyondTrust Remote Support messaging components to perform unauthorized file operations on an affected appliance without user interaction. The vulnera...