CISA warns of actively exploited authentication bypass in BeyondTrust Remote Support

What happened and what to do

The CISA advisory, published on October 16, 2026, covers CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support (formerly Bomgar), in versions 26.2.3 and earlier. A fix is available for supported versions, starting with 24.3.1; organizations on older versions must upgrade first. Threat actors are actively exploiting the flaw to gain initial access, establish persistence, escalate privileges and move laterally. The vulnerability was added to CISA's KEV catalog the same day. BeyondTrust-hosted SaaS deployments have already received the fix.

For a company running self-hosted appliances, the first step is to inventory versions and reduce external exposure of the access surface, restricting administrative interfaces to trusted networks. It should then apply fix BT26-05-RS and treat the exposure window as a possible incident: preserve snapshots or forensic images, forward syslog and session events to the SIEM, and hunt for unrecognized privileged sessions, unknown script files, logging gaps and changes to accounts and session policies. A log collection and monitoring pipeline with alerts on these indicators shortens the time between exposure and detection.

How the consultancy can help

Diagnosis of your Remote Support exposure: installed versions, external and administrative access, and log coverage. Then a scoped plan to apply the fix, collect forensic evidence and deploy privileged-session monitoring in your SIEM, with ongoing operation if wanted.

Next step

If your company uses BeyondTrust Remote Support, send a short description of your environment (version, deployment type, external exposure and logging tool). We will reply with a scoped proposal for diagnosis and response.