---
cve: "CVE-2026-102764"
severity: "CRITICAL"
cvss: 9.3
epss: "1.2%"
vendor: "BeyondTrust"
kev: true
exploited: true
published: "2026-10-15 20:30:32"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-26T18:58:13+01:00"
---

# CVE-2026-102764

> 9.3 CRITICAL · ⚠️ CISA KEV (10 Tage) · 🔓 Exploited

## Beschreibung

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

## CNA-Record (Kanon, cvelistV5)

- CNA: **BT**
- State: PUBLISHED
- Stand: 2026-10-17 03:55:27
- CNA-CVSS: **9.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA KEV seit: **16.10.2026**
- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **active**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-290** — Authentication Bypass by Spoofing
  This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

## Angriffsmuster (CAPEC)

- [CAPEC-21 — Exploitation of Trusted Identifiers](https://capec.mitre.org/data/definitions/21.html) _(Severity: High)_
- [CAPEC-22 — Exploiting Trust in Client](https://capec.mitre.org/data/definitions/22.html) _(Severity: High)_
- [CAPEC-59 — Session Credential Falsification through Prediction](https://capec.mitre.org/data/definitions/59.html) _(Severity: High)_
- [CAPEC-60 — Reusing Session IDs (aka Session Replay)](https://capec.mitre.org/data/definitions/60.html) _(Severity: High)_
- [CAPEC-459 — Creating a Rogue Certification Authority Certificate](https://capec.mitre.org/data/definitions/459.html) _(Severity: Very High)_
- [CAPEC-461 — Web Services API Signature Forgery Leveraging Hash Function Extension Weakness](https://capec.mitre.org/data/definitions/461.html) _(Severity: High)_
- [CAPEC-473 — Signature Spoof](https://capec.mitre.org/data/definitions/473.html)
- [CAPEC-476 — Signature Spoofing by Misrepresentation](https://capec.mitre.org/data/definitions/476.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1134 — Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)
- [T1528 — Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [T1539 — Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [T1134.001 — Access Token Manipulation:Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001/)
- [T1550.004 — Use Alternate Authentication Material:Web Session Cookie](https://attack.mitre.org/techniques/T1550/004/)
- [T1036.001 — Masquerading: Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001/)
- [T1553.002 — Subvert Trust Controls: Code Signing](https://attack.mitre.org/techniques/T1553/002/)

## BSI-Hinweise (deutsch)

- [BeyondTrust Remote Support: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-4001) — _BSI-Einstufung: kritisch_
  Ein entfernter, anonymer Angreifer kann eine Schwachstelle in BeyondTrust Remote Support ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

## Referenzen

- <https://nvd.nist.gov/vuln/detail/CVE-2026-102764>
- <https://www.beyondtrust.com/blog/entry/bt26-05>
- <https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-102764/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_