Will BeyondTrust Remote Support zero-day be added to CISA KEV by Dec 2026?

BeyondTrust warned customers on Thursday to patch a critical flaw in Remote Support (RS) that has been exploited in zero-day attacks since late August 2026 (Bleeping Computer). The vulnerability remains unpatched and is actively being exploited in the wild.

Resolution Criteria

Market resolves YES if CISA adds the BeyondTrust Remote Support zero-day CVE to the Known Exploited Vulnerabilities Catalog by December 31, 2026, based on official CISA KEV public listing. Resolves NO if no such addition occurs by deadline.