CISA 2026-10-16

CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

CVE-2026-102764 +1

Machine-generated analysis · WAYSCloud LLM

BeyondTrust Remote Support versions 26.2.3 and earlier are vulnerable to CVE-2026-102764.

Context

BeyondTrust Remote Support (formerly Bomgar) is a self-hosted remote support appliance. The advisory reports a critical authentication-bypass vulnerability (CVE-2026-102764) that is being actively exploited to gain initial access, establish persistence, elevate privileges, and move laterally. Patches are available for supported versions 24.3.1 and later, and SaaS deployments have already been patched. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog.

Operator considerations

Check: Verify the installed Remote Support version and whether the BT26-05-RS patch is applied.
Isolate: Segregate any appliance suspected of compromise and limit network access to trusted segments.
Patch: Apply the BT26-05-RS patch to versions 24.3.1 or later, upgrading older installations before patching.
Log: Enable and forward appliance syslog and session events for monitoring.

From Cybersecurity and Infrastructure Security Agency ↗

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026.

CISA urges organizations with affected self-hosted Remote Support appliances to immediately take the following actions:

Apply the BT26-05-RS patch, as outlined in BeyondTrust’s Security Advisory BT26-05. Organizations on a self-hosted Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply the patch. Organizations ...

Read the full advisory on CISA →