BeyondTrust published BT26-07 for an authentication bypass affecting Remote Support and Privileged Remote Access, tracked as CVE-2026-102764. NVD records a CVSS 3.1 base score of 9.2 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. CISA added the entry to the Known Exploited Vulnerabilities catalog on 16 October 2026.
Remote support appliances occupy an unusual position. They are reached from the internet because a vendor or helpdesk engineer needs to reach them from anywhere, and they are trusted by the internal estate because that is the entire point of the product. An authentication bypass on the appliance is therefore not a bug in a peripheral tool. It is a path to the sessions the appliance brokers.

What the record actually says

The CVE description describes an authentication bypass using an alternate path or channel that lets an unauthenticated attacker bypass the appliance's authentication, reach restricted functionality, and potentially achieve site user takeover.
Anyone who reads the NVD text in full will notice that the description repeats itself several times with small variations, and one inserted passage is visibly corrupted. That is a data quality problem in the record, not a subtlety of the vulnerability. When the NVD text is degraded, the vendor advisory is the only reliable statement of scope. BT26-07 is where the affected versions, the fixed builds, and the vendor's own characterization live.
The CVSS integrity component is Low while confidentiality and availability are High. The vector describes an attacker reading far more than they can change. Do not read that as reassurance. A read of the appliance's configured users, its site mappings, and its jump policies is enough to plan the next step with real names attached.

Site user takeover and why it compounds

"Site user takeover" is the phrase that deserves attention. On these appliances, users are grouped by site, and a site typically corresponds to a customer or a business unit. A takeover within one site is scoped damage. A takeover that crosses sites, or that reaches an administrative site, is a multi-tenant incident.
The practical consequence is that the usual containment instinct, isolating the appliance from the internet, has a cost. Remote support exists because someone has to reach it. The decision is not whether to expose the appliance but to whom, through what intermediary, and with what logging.

Actions that matter this week

Apply the fixed builds named in BT26-07 to both Remote Support and Privileged Remote Access. They are separate products with separate release cadences, and an estate that runs both needs both checked. Do not infer remediation from a version number that looks new.
Inventory every account with administrative rights on the appliance and every site mapping that crosses a trust boundary. If the bypass allowed site user takeover without authentication, the affected population is not limited to accounts that show a failed login.
Look at the appliance's own logs for sessions that were established without a preceding authentication event, and for administrative actions taken in those sessions. Then check the internal systems those sessions reached, because a jump from a support appliance usually lands on a host that trusts it.

Detection is not a log query

There is a temptation, when a bypass is published, to write a detection rule that searches for a specific request pattern. That rule will be wrong within a week if the vendor's advisory does not describe the request. The durable detection is behavioural: new sessions, new site memberships, new endpoint agents, and new credentials appearing on managed hosts outside a change window.
CISA's catalog listing adds urgency, but the date on the entry is not the date exploitation began. Assume an exposed appliance was probed before the catalog update and review logs back to a point before disclosure rather than before the KEV date.

The uncomfortable part

Remote support and privileged access products exist to concentrate trust. Every design decision that makes them convenient to operate also makes them valuable to an attacker who gets past the front door. CVE-2026-102764 is a vendor defect with a vendor fix, and the fix is available. The part that stays with the operator is the decision about how much of the estate a single appliance login should be able to reach, and whether that answer was ever written down.

References

  • BeyondTrust security advisory BT26-07, https://www.beyondtrust.com/security/advisories/BT26-07

  • NIST NVD record for CVE-2026-102764, https://nvd.nist.gov/vuln/detail/CVE-2026-102764

  • CISA Known Exploited Vulnerabilities catalog entry, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764