BeyondTrust Remote Support CVE-2026-102764 is being exploited: patch self-hosted appliances with BT26-05 and hunt

CISA says attackers are exploiting CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, and added it to the KEV catalog on October 16, 2026. Self-hosted appliances need the BT26-05-RS patch, after upgrading if older than 24.3.1; BeyondTrust-hosted SaaS deployments are already patched.

Source facts

CISA’s October 16, 2026 alert says CVE-2026-102764 is a critical authentication bypass affecting BeyondTrust Remote Support, formerly Bomgar, versions 26.2.3 and earlier, and that threat actors are exploiting it to gain initial access, then establish persistence, escalate privileges and move laterally. Patches exist for supported versions 24.3.1 and later, so older self-hosted installations must upgrade before applying the BT26-05-RS patch, while BeyondTrust-hosted SaaS deployments have already been patched, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.

CISA urges limiting external access to the appliance to the services needed to support users, restricting administrative interfaces to trusted networks, and running network and memory forensics on affected self-hosted appliances. If compromise is suspected, it says to isolate the appliance, take a snapshot or forensic image, forward appliance syslog and session events to the SIEM, and hunt for unrecognized privileged sessions, unrecognized script files, gaps in log forwarding and unauthorized account or session-policy changes.

After rebuilding from a known-good state and patching, CISA says to rotate every credential the appliance stored or injected, revoke all active support sessions and review new multifactor authentication registrations on privileged accounts.

Applicability

Use this for self-hosted BeyondTrust Remote Support appliances, including those run by IT service providers for their customers. Check BeyondTrust’s advisory BT26-05 for the exact fixed builds.

DSE recommendation

DSE recommends patching every self-hosted BeyondTrust Remote Support appliance with BT26-05-RS now, upgrading first if it runs a version older than 24.3.1. Treat unpatched internet-facing appliances as possibly compromised, restrict administrative access to trusted networks, forward appliance logs to the SIEM, and after any suspected compromise rebuild the appliance and rotate every credential it stored.

Verification

Confirm each appliance’s version and patch level, confirm admin interfaces are unreachable from the internet, and keep hunt results and credential rotation records with the incident file.

Official reference

CISA — CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support. Reviewed October 19, 2026.