CVE-2026-102764 explained: the Beyondtrust Remote Support flaw and how to fix it

The two-minute check

1. Think about the computer, phone, or server you run Beyondtrust Remote Support on. Does one exist in your business?
2. Look for a Beyondtrust Remote Support icon, running service, or app on that device.
3. Open the vendor's advisory page to compare your version against what it lists.
4. If an outside provider manages that device, ask them directly whether Beyondtrust Remote Support runs anywhere in your environment.

When you can stop reading

The record names only one product: Beyondtrust Remote Support. If you do not run this software, this flaw does not touch your business. If you are not sure, the safest move is to ask whoever manages your network rather than guess. Once you've confirmed it isn't installed anywhere, you're done here.

What the official record says

The National Vulnerability Database (NVD) scores this flaw 9.8 out of 10, rated CRITICAL, under Common Vulnerability Scoring System (CVSS) version 3.1 (NVD). The scoring details say an attacker needs no account and no password to try this. They also say no one at your business has to click a link or open a file for it to work. The attack can be attempted over a normal network connection, which is why the score sits so high.

This flaw is listed on the Known Exploited Vulnerabilities (KEV) catalog run by the Cybersecurity and Infrastructure Security Agency, which means real attackers are already using it, not just researchers (CISA KEV). It was added to that catalog on October 16, 2026, with a federal remediation due date of October 19, 2026 (CISA KEV entry). The record was published October 15, 2026 and last updated October 17, 2026 (NVD).

The Exploit Prediction Scoring System (EPSS) puts the probability of exploitation in the next 30 days at 0.6%, which sits at the 47.6th percentile compared with other flaws (FIRST.org EPSS). EPSS is a forecast of near-term exploitation activity, not a measure of how damaging the flaw itself could be. A low EPSS figure alongside a critical CVSS score simply means attackers haven't broadened their targeting yet, even though the flaw itself is serious and already confirmed on CISA's KEV list.

The vendor describes the underlying problem as internal components that fail to check where incoming messages actually come from. Under the right conditions, that lets an attacker perform file operations on the appliance without logging in first (NVD). The vendor has published a fix and an advisory (BeyondTrust advisory).

What that means for a business like yours

If Beyondtrust Remote Support sits on your network and is reachable, an attacker doesn't need a stolen password or a tricked employee to try this. That combination is what pushes the score so high. It doesn't mean every business running this software has already been hit. It does mean this isn't a "patch it next quarter" item.

If someone else manages your IT

Send your provider a short, direct message. Keep it to plain asks, one per sentence.

• "Do we run Beyondtrust Remote Support anywhere in our environment?"
• "If so, have we applied the fix for CVE-2026-102764?"
• "Can you confirm the current version in writing once it's done?"

A provider following current managed IT services practice should already be tracking this. If they can't answer quickly, that's worth noting for later.

If you manage it yourself

1. Open the vendor's advisory page for this flaw.
2. Find the version number or patch listed there for your product.
3. Log in to the Beyondtrust Remote Support administration console on the appliance.
4. Locate the update or patch management section, usually under system or software settings.
5. Apply the update the vendor lists, following the steps on their advisory page exactly.
6. Restart the service or appliance if the advisory instructs you to.
7. If you hit a permissions error during the update, check the vendor's permissions guidance (BeyondTrust permissions article).

The honest answer is now. This flaw is already on the CISA Known Exploited Vulnerabilities catalog, which only lists flaws with confirmed real-world attacks (CISA KEV catalog). Federal agencies were given until October 19, 2026 to fix it, which tells you how seriously CISA treats this one. Your business isn't bound by that federal deadline, but the same clock applies in practice. Treat this the same way you'd treat a locked front door with a known bad key already circulating.

Don't just trust that the installer finished without errors. Open the Beyondtrust Remote Support admin console again after the update completes. Check the version or build number shown there against the current version named in the vendor's advisory. If your provider did the work, ask them to send you a screenshot or short note confirming the version now matches. Keep that confirmation on file, since it's useful for any compliance review later.

If you can't apply the fix immediately, a few steps reduce your exposure without removing it. Restrict network access to the appliance so only known, trusted addresses can reach it, ideally through a virtual private network (VPN) rather than the open internet. Turn on multi-factor authentication (MFA) everywhere it's supported on the surrounding accounts, even though the flaw itself doesn't require a login to exploit. Point your endpoint detection and response (EDR) or monitoring tools at that device so unusual file activity gets flagged quickly. None of these steps replace the patch. They buy you time while you schedule it, and tightening remote access controls overall is good practice covered under privileged access management.

Do I have to do anything if we only use this at home?

The record doesn't separate home from business use. If Beyondtrust Remote Support runs on any device you're responsible for, apply the same fix there too.

Will patching this break anything?

The record doesn't say. Vendor updates like this are routine engineering work, and the advisory page is the best source for any known compatibility notes before you apply it.

How do we know if an attacker already used this against us?

The record doesn't list specific indicators of compromise. If you're concerned about prior activity, a cybersecurity review of your logs and appliance activity is the right next step.

Does this affect our other remote access tools?

The record names only Beyondtrust Remote Support. It doesn't mention any other product, so don't assume this extends beyond that one piece of software.

Does this matter for compliance, not just security?

If you handle health or financial data, unpatched critical flaws like this one can matter during a review. That's true whether you fall under HIPAA rules or the FTC Safeguards Rule. Documenting that you patched promptly is worth keeping on file either way.

LayerLogix brings 20+ years of experience and 100% Texas-based support to businesses across The Woodlands, Round Rock, Greater Houston, DFW, and Austin. If you want a second set of eyes on whether this flaw touches your network, start with a free IT assessment or contact us directly.