An administrator can fix the BeyondTrust flaw and still have an attacker holding a working password for another system. Fixing the defect alone cannot invalidate a password already copied out. The receiving system still accepts the credential.

An October 19 report says attackers exploited CVE-2026-102764 for seven weeks before disclosure, draining enterprise credential vaults. It attributes the operation to Chinese state actors. That attribution remains the report’s claim.

The vulnerability concerns improper origin validation in internal messaging components of BeyondTrust Remote Support. Our vulnerability feed records its addition to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on October 16. That establishes exploitation of the flaw; it does not independently establish who emptied a particular vault.

For the person restoring access, the vault theft changes the unit of recovery. A repaired BeyondTrust installation answers whether that entry point has been closed. It says nothing about whether a separate system will accept a stolen password.

The distinction has an operational cost. Replacing a vault entry and changing the password at the system it unlocks are separate actions. A new value stored in the vault cannot revoke the old value somewhere else.

Recovery therefore reaches beyond the affected product to credential replacement at those receiving systems. Until an exposed password is invalidated there, it can still admit an attacker to the system it unlocks.