CVE-2026-102764 in BeyondTrust Remote Support carries a 1% exploitation prediction, while the US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on October 16. Exploitation has already crossed from forecast to observation. The score still sits beside the entry.

The vulnerability concerns improper origin validation in internal messaging components. The Record reports that an alleged Chinese state-backed group is exploiting a new BeyondTrust zero-day for espionage. The attribution remains qualified. The catalog records exploitation.

For the administrator deciding which system gets the next maintenance slot, those facts arrive in a crowded queue. Our CVE Intel feed recorded eight additions to the agency’s exploited-vulnerability catalog among our tracked flaws in the seven days to October 17. BeyondTrust has company.

Sorting a maintenance queue by predicted exploitation can leave confirmed exploitation waiting. A percentage makes that ordering look quantitative. It still puts an estimate ahead of an observed attack.

Confirmed exploitation needs to override the forecast in remediation priorities. Otherwise, BeyondTrust Remote Support can wait behind a vulnerability with a higher predicted chance of something already happening to BeyondTrust.