# BeyondTrust Remote Support CVE-2026-102764 is being exploited: patch self-hosted appliances with BT26-05 and hunt > CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched. - Canonical URL: https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:28:21+00:00 - Modified: 2026-10-19T01:55:08+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Playbook - DSE priority: Critical - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched. ## Potentially affected Organizations and IT service providers that run self-hosted BeyondTrust Remote Support (formerly Bomgar) appliances, physical or virtual. ## DSE recommendation DSE recommends patching every self-hosted BeyondTrust Remote Support appliance with BT26-05-RS now, upgrading first if it runs a version older than 24.3.1. ## Article CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched. ## Source facts CISA’s [October 16, 2026 alert](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support) says CVE-2026-102764 is a critical authentication bypass affecting BeyondTrust Remote Support, formerly Bomgar, versions 26.2.3 and earlier, and that threat actors are exploiting it to gain initial access, then establish persistence, escalate privileges and move laterally. Patches exist for supported versions 24.3.1 and later, so older self-hosted installations must upgrade before applying the BT26-05-RS patch, while BeyondTrust-hosted SaaS deployments have already been patched, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day. CISA urges limiting external access to the appliance to the services needed to support users, restricting administrative interfaces to trusted networks, and running network and memory forensics on affected self-hosted appliances. If compromise is suspected, it says to isolate the appliance, take a snapshot or forensic image, forward appliance syslog and session events to the SIEM, and hunt for unrecognized privileged sessions, unrecognized script files, gaps in log forwarding and unauthorized account or session-policy changes. After rebuilding from a known-good state and patching, CISA says to rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor authentication registrations on privileged accounts. ## Applicability Use this for self-hosted BeyondTrust Remote Support appliances, including those run by IT service providers for their customers. Check BeyondTrust’s advisory BT26-05 for the exact fixed builds. ## DSE recommendation DSE recommends patching every self-hosted BeyondTrust Remote Support appliance with BT26-05-RS now, upgrading first if it runs a version older than 24.3.1. Treat unpatched internet-facing appliances as possibly compromised, restrict administrative access to trusted networks, forward appliance logs to the SIEM, and after any suspected compromise rebuild the appliance and rotate every credential it stored. ## Verification Confirm each appliance’s version and patch level, confirm admin interfaces are unreachable from the internet, and keep hunt results and credential rotation records with the incident file. ## Official reference [CISA — CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support). Reviewed October 19, 2026. ## Primary reference - Name: CISA — CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support - Authority: Cybersecurity and Infrastructure Security Agency - URL: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support - Source publication date: Not stated by the source ## Citation and use Preferred citation: “BeyondTrust Remote Support CVE-2026-102764 is being exploited: patch self-hosted appliances with BT26-05 and hunt,” DSE Security, https://update.dsesecurity.com/updates/beyondtrust-remote-support-cve-2026-102764-bt26-05-patch-self-hosted-appliances/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.