CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA says attackers are exploiting critical BeyondTrust Remote Support flaw CVE-2026-102764, now on KEV.
CISA warned that CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier, is being actively exploited for initial access, persistence, privilege escalation, and lateral movement. The agency added the flaw to the Known Exploited Vulnerabilities catalog on October 16, 2026. Supported self-hosted versions 24.3.1 and later need the BT26-05-RS patch, while older versions must upgrade first; BeyondTrust-hosted SaaS deployments are already patched. CISA also urged log and memory forensics, isolation of suspected appliances, credential rotation, and review of Mandiant's ARMORY CASTLE guidance.