# CVE-2026-102764 in Pulse: BeyondTrust Remote Support > Elsewhere, a separate section: not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence. Pulse's record of CVE-2026-102764 (BeyondTrust Remote Support): the evidence of exploitation as eight rungs, each with the capture it rests on, and the attention it gets. A separate section, not this site's evidence. # CVE-2026-102764: BeyondTrust Remote Support authentication bypass. remote access. Rungs reached: 4, 5 of 8. Part of [Pulse](../index.html), a separate section not about PHP. Why Pulse tracks it: KEV catalog 2026.10.21: added in the two weeks from 8 to 22 October 2026 ## The evidence of exploitation, rung by rung ### 1. A public proof of concept: not reached last checked 23 October 2026, 13:12 UTC ### 2. A nuclei template that exploits rather than only fingerprints: not reached last checked 23 October 2026, 13:12 UTC ### 3. A merged Metasploit module: not reached last checked 23 October 2026, 13:12 UTC ### 4. Exploitation attempts reported by a named party: reached 2026-10-15 - **BeyondTrust (vendor post, Oct 15, 2026; last updated October 16), with Mandiant** reached, 2026-10-15third-party text, as Pulse recorded it A suspected China-nexus espionage actor exploited a zero-day vulnerability. In collaboration with our Cybersecurity team, Mandiant is publishing its analysis of the same actor and vulnerability today. ... August 29, 2026: The actor exploited a zero-day vulnerability against a single BeyondTrust-hosted Remote Support instance and a single self-hosted Remote Support appliance.Pulse: The vendor reporting exploitation of two instances, one it hosts and one a customer runs. The customers are not named, so this is not a victim's own statement (rung 8).capture pulse: `raw/us/security-vendor/beyondtrust/bt26-05/20261022T221133Z/text.txt`, 22 October 2026, 22:11 UTC, sha256 `887662720887235b` [original](https://www.beyondtrust.com/blog/entry/bt26-05) ### 5. A KEV listing (the date added): reached 2026-10-16 - **Pulse's own check** 2026-10-16KEV catalog 2026.10.21capture pulse: `raw/us/registry/cisa-kev/kev-json/20261022T221059Z/text.txt`, 22 October 2026, 22:10 UTC, sha256 `97336b5231c74981` [original](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) ### 6. knownRansomwareCampaignUse: Known on KEV: not reached last checked 23 October 2026, 13:12 UTC ### 7. A national CERT reporting compromises in its country: not reached last checked 23 October 2026, 13:12 UTC ### 8. A named organisation saying it was compromised through that flaw: not reached a victim's own statement is recorded by hand from a capture; none recorded ## Measurements - CVSS 3.1 9.8, scored by nvd@nist.gov - CVSS 4.0 9.3, scored by 13061848-ea10-403d-bd75-c83a022c2891 - EPSS 0.0118, percentile 0.67433, 2026-10-22 ## The attention it gets 32 news items since 2026-09-23T13:26:52Z, counted over 53 of 137 feeds, in 23 languages and 30 countries; 0 front pages, 2 agency alerts, 0 pages advising taking systems offline. Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count Pulse vault `4klm5qlt`, head `3c14cab974e2`, last pass 23 October 2026, 13:12 UTC. --- site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/pulse/cve-2026-102764/index.html