BeyondTrust Remote Support flaw is being exploited

What happened

On 16 October 2026 CISA urged organisations to patch a critical vulnerability in BeyondTrust Remote Support (formerly Bomgar), tracked as CVE-2026-102764. It is an authentication bypass, which means an attacker can get in without valid credentials. CISA says attackers are actively exploiting it and added it to its Known Exploited Vulnerabilities catalog the same day.

Who is affected

• Self-hosted BeyondTrust Remote Support appliances on version 26.2.3 or earlier.
• BeyondTrust-hosted (SaaS) customers have already been patched, according to CISA.

What to do

1. Apply the patch described in BeyondTrust security advisory BT26-05. Patches are available for supported versions 24.3.1 and later. Older versions must be upgraded first.
2. Limit external access to the appliance to what is needed, and keep administration pages on trusted networks only.
3. If you suspect a compromise, isolate the appliance, keep a snapshot for investigators, and collect logs from your firewall and proxy for the exposure window.
4. Look for unknown privileged sessions, unfamiliar scripts, gaps in logs and unauthorised changes to accounts or permissions.
5. To recover, rebuild from a known-good state, apply the patch, rotate every credential the appliance stored, revoke active support sessions and review new multi-factor registrations on privileged accounts.

Why it matters even if you do not use it

Remote support tools can reach many computers by design, so an attacker who controls one gets a lot of access. If your team or a service provider uses a remote support product, ask which one and who keeps it updated. If you are unsure whether you are affected, ask your IT provider.