CISA is urging organizations to patch a critical authentication-bypass vulnerability in self-hosted BeyondTrust Remote Support. The agency says CVE-2026-102764 is being actively exploited to gain initial access, establish persistence, escalate privileges and move laterally through environments. It added the vulnerability to its Known Exploited Vulnerabilities catalog on October 16, 2026. [1]
The issue affects BeyondTrust Remote Support, formerly known as Bomgar, versions 26.2.3 and earlier. CISA says patches are available for supported versions 24.3.1 and later, while organizations running older versions must upgrade before applying the security fix. BeyondTrust-hosted SaaS deployments have already been patched, according to the alert. [1] [2]
Why remote-support systems deserve priority
Remote-support platforms sit close to privileged access. They may provide technicians with interactive sessions, administrative tools, file transfer, scripting and access to endpoints that are otherwise protected from the public internet. A flaw in the platform can therefore have consequences beyond the appliance itself.
The risk is not limited to whether an organization has public exposure. A self-hosted appliance may be reachable through a reverse proxy, VPN, firewall rule or vendor integration. Security teams should inventory the actual exposure path, not rely on assumptions based on the product’s intended deployment model.
CISA’s description also changes the response threshold. This is not a routine patching exercise where an organization can wait for the next maintenance window without investigation. Active exploitation means teams should determine whether the appliance was exposed during the relevant period and whether privileged sessions or stored credentials may have been accessed.
Required response
CISA recommends applying the BT26-05-RS patch and restricting external access to only the services needed for support operations. Administrative interfaces should be limited to trusted networks. These controls reduce exposure, but they do not replace patching or investigation. [1]
If compromise is suspected, the agency recommends isolating the appliance and preserving a virtual snapshot or forensic image. Teams should forward appliance syslog and session events to the SIEM, and collect related web-application-firewall, reverse-proxy and perimeter-firewall logs. Evidence preservation should happen before rebuilding where possible, because a rushed replacement can destroy information needed to understand the incident.
Hunting should look for unrecognized privileged sessions, unfamiliar script files, gaps in log forwarding and unauthorized changes to accounts, permissions or session policies. These indicators are useful because the vulnerability’s business impact depends on what an attacker did after authentication was bypassed.
Credential rotation is part of remediation
If the appliance stored or injected credentials, those credentials should be treated as exposed when compromise cannot be ruled out. CISA recommends rotating every credential stored by the appliance, revoking active support sessions and reviewing new multifactor-authentication registrations on privileged accounts. [1]
This step can be disruptive. Organizations should identify service accounts, emergency access procedures, automation credentials and third-party integrations before rotation begins. A partial rotation may leave the attacker’s path open, while an unplanned rotation can interrupt support operations without improving security.
The safest sequence is to isolate, preserve evidence, identify dependencies, rotate in a controlled order, rebuild from a known-good state and then restore service with the patch applied. Incident responders should document the decision points and maintain a clear record of which systems were reviewed.
What technology leaders should ask
Leaders should ask whether the organization operates a self-hosted Remote Support appliance, which versions are deployed, how it is exposed, and where its logs are stored. They should also ask whether the platform can inject credentials or reach privileged management networks.
If the answers are unclear, that uncertainty is itself a control gap. The organization should establish ownership, an inventory record, a patch path and a defined incident-response contact. A managed service provider may operate the product on behalf of the business, but responsibility for validating exposure and customer impact still needs to be assigned.
CVE-2026-102764 demonstrates why remote-access infrastructure needs a different response rhythm from ordinary business software. The combination of privileged access and active exploitation requires patching, containment, evidence preservation and credential hygiene as one response. Guava Systems can help organizations review remote-access exposure and coordinate prioritized remediation with broader identity and endpoint controls.
References
[1]: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support “CISA urges patching critical vulnerability in BeyondTrust Remote Support” [2]: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05 “BT26-05 security advisory — BeyondTrust” [3]: https://www.cve.org/CVERecord?id=CVE-2026-102764 “CVE-2026-102764 — CVE.org”
