Government Advisory

CISA Warns Attackers Are Exploiting Critical BeyondTrust Remote Support Flaw

CISA · 16 Oct 2026

Key Takeaway If your business runs a self-hosted BeyondTrust Remote Support appliance, patch it immediately, restrict its external and administrative access, and check for signs of compromise.

The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that a critical authentication bypass vulnerability, tracked as CVE-2026-102764, is being actively exploited in BeyondTrust Remote Support (formerly Bomgar). It affects versions 26.2.3 and earlier. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 16 October 2026. Attackers are using it to gain initial access, then establish persistence, escalate privileges and move laterally through networks.

Patches are available for supported versions (24.3.1 and later) under BeyondTrust Security Advisory BT26-05. Organisations running older self-hosted versions must upgrade before they can apply the patch. BeyondTrust-hosted (SaaS) deployments have already been patched. CISA also advises limiting external access to the appliance to only what is needed, and restricting administrative interfaces to trusted networks.

Organisations with affected self-hosted appliances should conduct network and memory forensics to look for signs of compromise. If a compromise is suspected, CISA recommends isolating the appliance and preserving a snapshot or forensic image for later investigation.

BeyondTrust CISA Authentication Bypass Patch Management Known Exploited Vulnerabilities

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.