Rapid7 has published an Emergent Threat Response analysis of a critical authentication bypass vulnerability affecting BeyondTrust Remote Support that it says is being actively exploited.
The vulnerability, tracked as CVE-2026-102764 and rated 9.3 in severity, allows unauthenticated attackers to perform file operations on vulnerable systems without user interaction, according to the Rapid7 analysis.
Rapid7 said its investigations linked exploitation activity to a suspected China-linked espionage group. The company said attackers have deployed web shells, established persistent access, attempted to steal credentials, and deleted logs to conceal their activity.
The flaw affects BeyondTrust Remote Support versions 26.2.3 and earlier, with confirmed compromises dating back to August 2026, Rapid7 said.
Rapid7 also noted the vulnerability has been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue.
Rapid7 urged organisations to apply emergency patches and to investigate systems for signs of compromise, warning that patching alone may not remove an attacker’s existing access or persistence mechanisms.
The full Rapid7 analysis, including mitigation guidance and indicators of compromise, is available on the company’s website.
