CVE-2026-102764: BeyondTrust Remote Support

1. A public proof of concept: not reached

2. A nuclei template that exploits rather than only fingerprints: not reached

3. A merged Metasploit module: not reached

4. Exploitation attempts reported by a named party: reached 2026-10-15

• BeyondTrust (vendor post, Oct 15, 2026; last updated October 16), with Mandiant reached, 2026-10-15

  third-party text, as Pulse recorded it
  A suspected China-nexus espionage actor exploited a zero-day vulnerability. In collaboration with our Cybersecurity team, Mandiant is publishing its analysis of the same actor and vulnerability today. ... August 29, 2026: The actor exploited a zero-day vulnerability against a single BeyondTrust-hosted Remote Support instance and a single self-hosted Remote Support appliance.

  Pulse: The vendor reporting exploitation of two instances, one it hosts and one a customer runs. The customers are not named, so this is not a victim's own statement (rung 8).
  capture pulse: raw/us/security-vendor/beyondtrust/bt26-05/20261022T221133Z/text.txt, 22 October 2026, 22:11 UTC, sha256 887662720887235b original

5. A KEV listing (the date added): reached 2026-10-16

• Pulse's own check 2026-10-16
  KEV catalog 2026.10.21
  capture pulse: raw/us/registry/cisa-kev/kev-json/20261022T221059Z/text.txt, 22 October 2026, 22:10 UTC, sha256 97336b5231c74981 original

6. knownRansomwareCampaignUse: Known on KEV: not reached

7. A national CERT reporting compromises in its country: not reached

8. A named organisation saying it was compromised through that flaw: not reached

a victim's own statement is recorded by hand from a capture; none recorded