BeyondTrust Remote Support flaw added to US exploited-bugs list — here's what we actually know
CISA says CVE-2026-102764 is being actively exploited, but the public record is light on exactly how — and whether it touches anyone outside big organisations.
A vulnerability in BeyondTrust’s Remote Support software, tracked as CVE-2026-102764, has been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue. The listing, dated 16 October 2026, means CISA has confirmed real-world exploitation — not a theoretical risk flagged by researchers, but attacks that have actually happened.
That matters because KEV entries only get added once CISA has evidence the bug is being used in the wild. US federal civilian agencies have been given until 19 October 2026 — a three-day turnaround — to apply fixes or mitigations, which is about as urgent as these directives get.
What we actually know
The confirmed facts here are narrow: there’s a flaw in BeyondTrust Remote Support, it has a CVE number, it’s on the KEV list, and the clock is ticking for US government bodies to deal with it. CISA’s own entry doesn’t specify how the bug is being exploited, who’s behind the attacks, or how widespread the activity is. The “ransomware” field on the listing is marked “Unknown,” meaning CISA hasn’t tied this to any known ransomware campaign — not that it’s definitely unconnected, just that nobody’s confirmed a link either way.
The NVD page for CVE-2026-102764 is the usual place to look for a technical breakdown — severity score, attack vector, whether authentication is required — but at the time of writing it doesn’t carry enough detail to say anything more specific than “a vulnerability exists and is being exploited.” That’s a frustratingly common gap with freshly-added KEV entries: the catalogue exists to force action, not to explain the plumbing.
So who is actually at risk
BeyondTrust Remote Support is enterprise remote-access software, the kind used by IT help desks and support teams to connect into machines on a network. It’s not a consumer product, so this isn’t something that affects your home laptop or a personal BeyondTrust account — because there isn’t really such a thing. The people who need to care are organisations, particularly US federal agencies under CISA’s binding directive, and any business or public body running BeyondTrust Remote Support internally, regardless of which country they’re in.
Given that this is exactly the kind of tool used to grant remote access to internal systems, a working exploit is a meaningful foothold for an attacker if left unpatched — which is presumably why CISA moved fast on the deadline.
What to do about it
If your organisation runs BeyondTrust Remote Support, the only sensible move is to check with BeyondTrust directly for patches or mitigation guidance and apply them without delay, rather than waiting to see whether more detail emerges. CISA’s directive specifically points administrators towards its BOD 26-04 guidance on prioritising security updates by risk, which is standard practice for anything landing on the KEV list with a short fuse.
For everyone else — anyone not running this specific enterprise software — there’s genuinely nothing to do here. This is an IT-department problem, not a household one.
The takeaway
This is a real, confirmed case of active exploitation against enterprise software, and the urgency from CISA is genuine. But the public technical detail is currently thin, and the blast radius is organisations running a specific remote-support tool — not the general public. Worth noting, not worth panicking about unless BeyondTrust Remote Support happens to be sitting on your network.