CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched.
\nCISA’s October 16, 2026 alert says CVE-2026-102764 is a critical authentication bypass affecting BeyondTrust Remote Support, formerly Bomgar, versions 26.2.3 and earlier, and that threat actors are exploiting it to gain initial access, then establish persistence, escalate privileges and move laterally. Patches exist for supported versions 24.3.1 and later, so older self-hosted installations must upgrade before applying the BT26-05-RS patch, while BeyondTrust-hosted SaaS deployments have already been patched, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.
\nCISA urges limiting external access to the appliance to the services needed to support users, restricting administrative interfaces to trusted networks, and running network and memory forensics on affected self-hosted appliances. If compromise is suspected, it says to isolate the appliance, take a snapshot or forensic image, forward appliance syslog and session events to the SIEM, and hunt for unrecognized privileged sessions, unrecognized script files, gaps in log forwarding and unauthorized account or session-policy changes.
\nAfter rebuilding from a known-good state and patching, CISA says to rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor authentication registrations on privileged accounts.
\nUse this for self-hosted BeyondTrust Remote Support appliances, including those run by IT service providers for their customers. Check BeyondTrust’s advisory BT26-05 for the exact fixed builds.
\nDSE recommends patching every self-hosted BeyondTrust Remote Support appliance with BT26-05-RS now, upgrading first if it runs a version older than 24.3.1. Treat unpatched internet-facing appliances as possibly compromised, restrict administrative access to trusted networks, forward appliance logs to the SIEM, and after any suspected compromise rebuild the appliance and rotate every credential it stored.
\nConfirm each appliance’s version and patch level, confirm admin interfaces are unreachable from the internet, and keep hunt results and credential rotation records with the incident file.
\nCISA — CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support. Reviewed October 19, 2026.
", "content_text": "CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched.\nSource facts\nCISA’s October 16, 2026 alert says CVE-2026-102764 is a critical authentication bypass affecting BeyondTrust Remote Support, formerly Bomgar, versions 26.2.3 and earlier, and that threat actors are exploiting it to gain initial access, then establish persistence, escalate privileges and move laterally. Patches exist for supported versions 24.3.1 and later, so older self-hosted installations must upgrade before applying the BT26-05-RS patch, while BeyondTrust-hosted SaaS deployments have already been patched, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.\nCISA urges limiting external access to the appliance to the services needed to support users, restricting administrative interfaces to trusted networks, and running network and memory forensics on affected self-hosted appliances. If compromise is suspected, it says to isolate the appliance, take a snapshot or forensic image, forward appliance syslog and session events to the SIEM, and hunt for unrecognized privileged sessions, unrecognized script files, gaps in log forwarding and unauthorized account or session-policy changes.\nAfter rebuilding from a known-good state and patching, CISA says to rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor authentication registrations on privileged accounts.\nApplicability\nUse this for self-hosted BeyondTrust Remote Support appliances, including those run by IT service providers for their customers. Check BeyondTrust’s advisory BT26-05 for the exact fixed builds.\nDSE recommendation\nDSE recommends patching every self-hosted BeyondTrust Remote Support appliance with BT26-05-RS now, upgrading first if it runs a version older than 24.3.1. Treat unpatched internet-facing appliances as possibly compromised, restrict administrative access to trusted networks, forward appliance logs to the SIEM, and after any suspected compromise rebuild the appliance and rotate every credential it stored.\nVerification\nConfirm each appliance’s version and patch level, confirm admin interfaces are unreachable from the internet, and keep hunt results and credential rotation records with the incident file.\nOfficial reference\nCISA — CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support. Reviewed October 19, 2026.", "content_markdown": "CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched.\n\n## Source facts\n\nCISA’s [October 16, 2026 alert](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support) says CVE-2026-102764 is a critical authentication bypass affecting BeyondTrust Remote Support, formerly Bomgar, versions 26.2.3 and earlier, and that threat actors are exploiting it to gain initial access, then establish persistence, escalate privileges and move laterally. Patches exist for supported versions 24.3.1 and later, so older self-hosted installations must upgrade before applying the BT26-05-RS patch, while BeyondTrust-hosted SaaS deployments have already been patched, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.\n\nCISA urges limiting external access to the appliance to the services needed to support users, restricting administrative interfaces to trusted networks, and running network and memory forensics on affected self-hosted appliances. If compromise is suspected, it says to isolate the appliance, take a snapshot or forensic image, forward appliance syslog and session events to the SIEM, and hunt for unrecognized privileged sessions, unrecognized script files, gaps in log forwarding and unauthorized account or session-policy changes.\n\nAfter rebuilding from a known-good state and patching, CISA says to rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor authentication registrations on privileged accounts.\n\n## Applicability\n\nUse this for self-hosted BeyondTrust Remote Support appliances, including those run by IT service providers for their customers. Check BeyondTrust’s advisory BT26-05 for the exact fixed builds.\n\n## DSE recommendation\n\nDSE recommends patching every self-hosted BeyondTrust Remote Support appliance with BT26-05-RS now, upgrading first if it runs a version older than 24.3.1. Treat unpatched internet-facing appliances as possibly compromised, restrict administrative access to trusted networks, forward appliance logs to the SIEM, and after any suspected compromise rebuild the appliance and rotate every credential it stored.\n\n## Verification\n\nConfirm each appliance’s version and patch level, confirm admin interfaces are unreachable from the internet, and keep hunt results and credential rotation records with the incident file.\n\n## Official reference\n\n[CISA — CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/", "url": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "BeyondTrust Remote Support CVE-2026-102764 is being exploited: patch self-hosted appliances with BT26-05 and hunt", "item": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/#article", "identifier": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/", "url": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/", "headline": "BeyondTrust Remote Support CVE-2026-102764 is being exploited: patch self-hosted appliances with BT26-05 and hunt", "description": "CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to…", "abstract": "CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched.", "articleBody": "CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched.\nSource facts\nCISA’s October 16, 2026 alert says CVE-2026-102764 is a critical authentication bypass affecting BeyondTrust Remote Support, formerly Bomgar, versions 26.2.3 and earlier, and that threat actors are exploiting it to gain initial access, then establish persistence, escalate privileges and move laterally. Patches exist for supported versions 24.3.1 and later, so older self-hosted installations must upgrade before applying the BT26-05-RS patch, while BeyondTrust-hosted SaaS deployments have already been patched, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.\nCISA urges limiting external access to the appliance to the services needed to support users, restricting administrative interfaces to trusted networks, and running network and memory forensics on affected self-hosted appliances. If compromise is suspected, it says to isolate the appliance, take a snapshot or forensic image, forward appliance syslog and session events to the SIEM, and hunt for unrecognized privileged sessions, unrecognized script files, gaps in log forwarding and unauthorized account or session-policy changes.\nAfter rebuilding from a known-good state and patching, CISA says to rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor authentication registrations on privileged accounts.\nApplicability\nUse this for self-hosted BeyondTrust Remote Support appliances, including those run by IT service providers for their customers. Check BeyondTrust’s advisory BT26-05 for the exact fixed builds.\nDSE recommendation\nDSE recommends patching every self-hosted BeyondTrust Remote Support appliance with BT26-05-RS now, upgrading first if it runs a version older than 24.3.1. Treat unpatched internet-facing appliances as possibly compromised, restrict administrative access to trusted networks, forward appliance logs to the SIEM, and after any suspected compromise rebuild the appliance and rotate every credential it stored.\nVerification\nConfirm each appliance’s version and patch level, confirm admin interfaces are unreachable from the internet, and keep hunt results and credential rotation records with the incident file.\nOfficial reference\nCISA — CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support. Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:28:21+00:00", "dateModified": "2026-10-19T01:55:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "BeyondTrust Remote Support CVE-2026-102764 is being exploited: patch self-hosted appliances with BT26-05 and hunt" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Playbook", "Critical priority" ], "genre": "Playbook", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 368, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA — CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support", "url": "https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support" } } ] } }