BeyondTrust Remote Support, now shipping with Beyond Trust™ authentication
CVE-2026-102764, CVSS 9.3. The appliance simply did not check where messages came from. Unauth file ops, zero clicks, zero fucks given.
Exploited since August. Patched in October. That's a zero-day with a seven week head start.
Second critical of 2026 after February's RCE-to-ransomware speedrun. It's not PAM, it's a PAMphlet on how not to do auth.
The product name was a warning label this whole time.
#CISAUrgesYou #infosec #BeyondTrust #PatchYourShit #OnTheKEV