CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support

CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026.  CISA urges organizations with affected self-hosted Remote Support appliances to immediately take the following actions:  Apply the BT26-05-RS pat

Why it matters

Exploitation is already occurring or the issue is explicitly prioritized by defenders. Validate exposure before lower-priority patch work.

What defenders should do

Check exposure now; patch or mitigate; hunt for signs of exploitation on affected assets.

Verify at the source

CyberKit curates and prioritizes; the source remains authoritative. Read the original advisory at www.cisa.gov →