CVE-2026-102764 in BeyondTrust Remote Support: what is confirmed and what is not

A critical authentication bypass, CVE-2026-102764 (CVSS 9.8), affects BeyondTrust Remote Support and is confirmed exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on October 16, 2026, and the campaign is attributed to UNC5221. A fingerprint search found 2,185 Bomgar assets, a reachability count rather than a compromise count.

• CVSS 4.0 score is 9.3, CVSS 3.1 is 9.8, no privileges or user interaction needed
• CISA added the CVE to KEV on October 16, 2026, with an October 19 deadline
• Fingerprint search found 2,185 Bomgar assets as of October 26
• The actor reportedly took every stored credential and planted changes surviving resets