BeyondTrust Remote Support CVE-2026-102764 added to CISA KEV

BeyondTrust Remote Support CVE-2026-102764 is actively exploited

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on October 16. The one to act on first is CVE-2026-102764, an authentication bypass by spoofing in BeyondTrust Remote Support, carrying a CVSS score of 9.8. The other add is CVE-2025-61624, a Fortinet path traversal flaw across multiple products rated 6.5.

The BeyondTrust flaw is not theoretical. Multiple outlets report a suspected Chinese espionage group has exploited it as a zero-day since August to gain root access and deploy backdoors, reportedly reaching full admin access in minutes. CISA issued a dedicated advisory urging patching. When a remote support tool that holds privileged access to your endpoints is being used to gain root, this moves from patch eventually to patch now.

• CVE-2026-102764 BeyondTrust Remote Support, CVSS 9.8, KEV listed, exploited since August
• CVE-2025-61624 Fortinet multiple products path traversal, CVSS 6.5, KEV listed

ConnectWise supply-chain attack hits 173 Microsoft 365 accounts

If you run Microsoft 365, the ConnectWise story matters directly. BleepingComputer and Cyber Security News report attackers used compromised ConnectWise backup credentials to breach Microsoft 365 tenants, with 173 accounts affected in a supply-chain attack. No CVE is attached, so the fix is operational: rotate ConnectWise credentials, review tenant access, and hunt for unexpected sign-ins tied to that integration.

On a related note, attackers are abusing roughly 20,000 Cloudflare Pages domains to push fake Microsoft security alerts, so expect phishing that impersonates the same brand your users trust.

KEV movers and the hot exploitation list

Beyond the new adds, the active exploitation picture is crowded with ransomware-linked critical flaws already in KEV. CVE-2026-63077 in JetBrains TeamCity (CVSS 9.8, EPSS 0.8957), CVE-2026-35273 in Oracle PeopleSoft (CVSS 9.8, EPSS 0.9668), and CVE-2026-41940 in WebPros cPanel and WHM (CVSS 9.8, EPSS 0.9853) are all KEV listed and ransomware linked. CVE-2026-104935, an Ivanti Connect Secure authentication bypass (CVSS 8.6), tops the hot list and is also KEV listed.

CISA also still flags CVE-2026-0322 in Palo Alto Networks PAN-OS as exploited in attacks. Older KEV entries remain in play too, including ProFTPD CVE-2015-3306 and Apache Struts CVE-2016-3081.

Senserva's non-Microsoft exploited-CVE tracker follows these KEV additions daily, so you can confirm whether BeyondTrust, Fortinet, or any of the hot movers touch your estate.

Microsoft Office RCE patches and this month's rollups

SecurityWeek reports Microsoft patched two dozen remote code execution flaws in Office this cycle. The hot KB list is dominated by critical cumulative updates carrying KEV-listed content, including KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022, and KB5126657 for Windows 10 version 21H2. Prioritize the rollups that cover server roles first.

Senserva's free Microsoft Patch Tracker ranks open Microsoft patches by CISA KEV, EPSS, and ransomware linkage, which helps you sequence this month's Office and Windows updates against what is actually being exploited.

Do this first

A short, grounded action list for today:

• Patch BeyondTrust Remote Support for CVE-2026-102764 now and hunt for backdoors and root-level activity dating back to August.
• Rotate ConnectWise backup credentials and audit Microsoft 365 tenant access for the 173-account supply-chain breach pattern.
• Apply the Fortinet fix for CVE-2025-61624 now that it is KEV listed.
• Deploy the critical Windows rollups and this month's Office RCE patches, starting with server roles.
• Warn users about fake Microsoft security alerts served from Cloudflare Pages domains.

Sources

• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-16)
• CISA Cybersecurity Advisories: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support (2026-10-16)
• Cyber Security News: Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors (2026-10-16)
• Cyber Security News: BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes (2026-10-16)
• SecurityWeek: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day (2026-10-16)
• The Record: Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day (2026-10-16)
• Cyber Security News: Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts (2026-10-17)
• BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (2026-10-17)
• Cyber Security News: Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (2026-10-16)
• SecurityWeek: Microsoft Patches Two Dozen RCE Flaws in Office (2026-10-16)
• Cyber Security News: CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks (2026-10-16)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-18.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.