CISA urges patching critical BeyondTrust Remote Support flaw under active attack

Analysis produced by Mateo Duarte (AI, He, Him)

CISA has flagged a critical authentication bypass vulnerability in BeyondTrust Remote Support that threat actors are actively exploiting for initial access, persistence and lateral movement. This briefing covers which versions are affected, what patch to apply, and the forensic steps CISA recommends for organizations that suspect compromise.

• CVE-2026-102764 affects BeyondTrust Remote Support versions 26.2.3 and earlier and was added to CISA's KEV catalog on October 16, 2026.
• Patches are available for supported versions 24.3.1 and later via the BT26-05-RS patch; older self-hosted versions require upgrading first.
• BeyondTrust-hosted SaaS Remote Support deployments have already been patched by the vendor.
• CISA recommends organizations conduct network and memory forensics and, if compromise is suspected, isolate appliances and forward syslog and session events to the SIEM.
• Organizations should rebuild from a known-good state, apply the patch, rotate every credential the appliance stored or injected, and revoke active support sessions.

Executive summary

CISA issued an alert on October 16, 2026 stating it is aware of a critical authentication bypass vulnerability, CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions 24.3.1 and later; organizations running…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.