CISA warns of active exploitation of critical BeyondTrust Remote Support flaw

On October 16, 2026, CISA said it is aware of a critical authentication bypass vulnerability, CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) in versions 26.2.3 and earlier. Fixes exist for supported versions, starting at 24.3.1; organizations on older versions must upgrade first. Threat actors are actively exploiting the flaw to gain initial access and then establish persistence, escalate privileges and move laterally. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on the same date. BeyondTrust-hosted SaaS deployments have already received the fix; self-hosted appliances must apply fix BT26-05-RS, as described in BeyondTrust Security Advisory BT26-05. Recommended measures include limiting external access to the services needed, restricting administrative interfaces to trusted networks and performing network and memory forensic analysis. If compromise is suspected, the guidance is to isolate affected appliances, collect a snapshot or forensic image, forward appliance syslog and session events to the SIEM and gather application firewall, reverse proxy and perimeter logs covering the exposure period. Look for unrecognized privileged sessions, unknown script files, logging gaps and unauthorized changes to accounts, permissions or session policies. CISA also cites Binding Operational Directive 26-04. For details, consult CISA's official alert and the BeyondTrust material it mentions.