CISA has issued an urgent call for organizations to patch a critical vulnerability in BeyondTrust Remote Support that threat actors are actively exploiting to gain initial access to networks, according to a CISA alert. The authentication bypass vulnerability, CVE-2026-102764, affects versions 26.2.3 and earlier and has been added to CISA's Known Exploited Vulnerabilities catalog. Patches are available for supported versions, but organizations using older versions must upgrade first. Cyber threat actors are exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA urges organizations with affected self-hosted Remote Support appliances to immediately apply the BT26-05-RS patch, as outlined in BeyondTrust's Security Advisory BT26-05.
What happened
CISA added the critical authentication bypass vulnerability CVE-2026-102764 affecting BeyondTrust Remote Support (formerly Bomgar) to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026. The vulnerability, which allows unauthenticated remote attackers to bypass authentication and access the appliance, is being actively exploited by cyber threat actors to gain initial access to vulnerable systems. After initial access, the threat actors establish persistence, escalate privileges, and move laterally within the target environment.
BeyondTrust released patches for CVE-2026-102764 in the BT26-05-RS update for supported versions of BeyondTrust Remote Support. Organizations using older, unsupported versions must upgrade to a supported version before applying the patch. CISA recommends that organizations with affected self-hosted Remote Support appliances take immediate action to mitigate the vulnerability:
- Apply the BT26-05-RS patch, as outlined in BeyondTrust's Security Advisory BT26-05
- Upgrade to a supported version of BeyondTrust Remote Support (24.3.1 and later)
- Verify the version of BeyondTrust Remote Support in use and apply the appropriate patch or upgrade
- Monitor for indicators of compromise (IoCs) related to the exploitation of CVE-2026-102764
In addition to the CISA advisory, other security sources reported that Chinese state-sponsored threat actors, known as Armory Castle, were exploiting the vulnerability in zero-day attacks to gain initial access to target systems.
Why it matters
CISA's urgent recommendation to patch a critical vulnerability in BeyondTrust Remote Support highlights the ongoing threat of exploited software bugs. Cyber threat actors are actively exploiting CVE-2026-102764 to gain initial access, establish persistence, escalate privileges, and move laterally in targeted networks. This vulnerability, affecting BeyondTrust Remote Support versions 26.2.3 and earlier, underscores the need for organizations to stay vigilant and promptly address known vulnerabilities.
Organizations using BeyondTrust Remote Support must apply the available BT26-05-RS patch, as outlined in BeyondTrust's Security Advisory BT26-05, to mitigate the risk of exploitation. Those on older versions must also upgrade to supported versions (24.3.1 and later) to patch the vulnerability. CISA's inclusion of CVE-2026-102764 in its Known Exploited Vulnerabilities catalog further emphasizes the severity of this issue and the importance of taking immediate action to protect against potential attacks.
The exploitation of this vulnerability highlights the ongoing threat of cyber attacks and the need for organizations to maintain a strong security posture. Failure to patch known vulnerabilities can lead to significant operational and reputational risks, as demonstrated by the active exploitation of CVE-2026-102764. IT teams must prioritize the patching of critical vulnerabilities and implement robust security controls to detect and prevent potential breaches.
What to do
- Affected organizations should immediately apply the BT26-05-RS patch to their BeyondTrust Remote Support appliances, as outlined in the manufacturer's security advisory BT26-05. This patch addresses the critical CVE-2026-102764 vulnerability.
- Organizations using older versions of BeyondTrust Remote Support (24.3.1 and earlier) must first upgrade to a supported version before applying the patch, due to the potential compatibility issues with older releases.
- Administrators should review their network for any BeyondTrust Remote Support appliances and ensure they are updated to a patched version as soon as possible to prevent exploitation.
- It is crucial to monitor for any suspicious activity or signs of compromise on the network after applying the patch, as threat actors may have already exploited the vulnerability to gain initial access.
- Organizations should also review their security policies and incident response plans to ensure they can quickly detect and respond to potential exploitation attempts in the future, and to minimize the potential impact of successful attacks.
2TI lens
The critical vulnerability in BeyondTrust Remote Support highlighted by CISA shows why comprehensive, proactive vulnerability management is crucial for enterprise security. Organizations must prioritize patching known vulnerabilities like CVE-2026-102764 before attackers can exploit them for initial access and lateral movement. This incident also underscores the importance of monitoring for signs of compromise and responding quickly to minimize damage. Robust threat intelligence, incident response plans, and collaboration between security teams can help organizations stay ahead of attackers targeting commonly used software.
Sources CISA News reported on Oct. 16, 2026 that CISA is aware of a critical authentication bypass vulnerability CVE-2026-102764 affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. [1] The agency added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. [1] Dark Reading noted that Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. [2] The Record reported on Oct. 16 that an alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks. [3] SecurityWeek reported that Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts. [4]