NewsCSO Online
BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alertType Vulnerability
BeyondTrust
BeyondTrust Zero-Day CVE-2026-102764 Explained [2026] - https://tech-insider.org/
2 sourcesCVE-2026-102764
At a glance
High
Suggested 24-hour window, counted from the last update
ActiveConfirmed in-the-wild exploitation
Evidence-weighted, not popularity
Signal
Actively exploited in the wild — prioritise confirming exposure.
Why High
High rather than Critical: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on BeyondTrust Remote Support, treat it as Critical.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Do we run BeyondTrust Remote Support, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2026-102764- 9.3 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Listed: attacks using it have been seen
- Elevated attack likelihood (~78% in 30 days)
No technical write-up beyond these facts and the summary below yet.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert CSO Online
- CVE-2026-102764 is confirmed as exploited in the wild (US known-exploited catalogue)
- CVE-2026-102764 has an estimated ~19% chance of attack in 30 days (97.3th percentile) as of 2026-10-27 — probability signal, not confirmed exploitation
- Authoritative catalogues report active exploitation of this vulnerability.
Products and services involved
- BeyondTrust Remote Support93% match confidence · CVE-2026-102764
4 reports
Part of BeyondTrust Zero-Day CVE-2026-102764: China APT, CVSS 9.3
Same event, different frames
Distinct often headline the same incident differently.
Newshttps://tech-insider.org/
BeyondTrust Zero-Day CVE-2026-102764 Explained [2026] - https://tech-insider.org/Pulse
Last checked 3d ago · Recheck overdue since 6 Nov 2026, 14:34 UK time · 1 quiet check collapsed
- Story16 Oct 2026, 14:06 UK time · 16 Oct
Linked reporting from CSO Online (independent original reporter).
Read source (CSO Online) - Story28 Oct 2026, 12:14 UK time · 28 Oct
Linked reporting from https://tech-insider.org/ (independent original reporter).
Read source (https://tech-insider.org/) - Update5 Nov 2026, 14:34 UK time · 3d ago
held at 18.9%; ranking metadata was updated.
3 entries so far. The timeline chart appears once this story has more history.
Sources
- CSO OnlineNews
BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert
BeyondTrust Zero-Day CVE-2026-102764 Explained [2026] - https://tech-insider.org/
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-102764
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-102764 is confirmed as exploited in the wild (US known-exploited catalogue)
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-102764 has an estimated ~19% chance of attack in 30 days (97.3th percentile) as of 2026-10-27 — probability signal, not confirmed exploitation
- ProbableSummary fact75% confidence
BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert CSO Online