CISA urges patching of exploited BeyondTrust Remote Support flaw
The United States Cybersecurity and Infrastructure Security Agency has urged organisations to patch a critical authentication bypass vulnerability in BeyondTrust Remote Support, warning that threat actors are actively exploiting it. The flaw, tracked as CVE-2026-102764, affects self-hosted Remote Support versions 26.2.3 and earlier, and CISA added it to its Known Exploited Vulnerabilities catalogue on 16 October 2026.
How the flaw is being used
CISA says attackers are exploiting the vulnerability to gain initial access, then establish persistence, escalate privileges and move laterally inside networks. Remote support tools are a high-value target because they are designed to give trusted, privileged access to other systems, so a bypass in that control point can open far more than a single workstation. BeyondTrust, formerly Bomgar, has issued the BT26-05-RS patch for supported versions, and organisations running versions older than 24.3.1 must upgrade first before they can apply it. BeyondTrust-hosted software-as-a-service deployments have already been patched, according to the vendor.
What administrators should do
CISA urges affected organisations to apply the patch immediately, limit external access to the remote support appliance to only the services needed, and restrict administrative interfaces to trusted networks. Where compromise is suspected, network and memory forensics are needed to look for evidence, since patching alone does not remove an attacker who is already inside. SC Media's reporting confirms the KEV addition alongside a Fortinet flaw exploited by malware, underlining a busy October for edge and remote-access vulnerabilities. Any organisation running self-hosted BeyondTrust Remote Support should check its version now rather than waiting for the next maintenance window.
