CISA has called for immediate patching of a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) software. The flaw, tracked as CVE-2026-102764, allows unauthorized remote code execution and has been actively exploited by cyber threat actors for initial access, according to the agency's alert.
BeyondTrust released patches for supported versions of the software on October 15th, 2026, and urged all affected customers to apply the updates immediately. Organizations running unsupported versions must first upgrade to a supported version before applying the patch, the company warned.
What happened
CISA added a critical authentication bypass vulnerability (CVE-2026-102764) in BeyondTrust Remote Support to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally.
BeyondTrust Remote Support, formerly known as Bomgar, is a remote access solution used by many organizations. The vulnerability affects versions 26.2.3 and earlier, according to CISA.
Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first.
Cybersecurity firm Proofpoint identified multiple threat actors exploiting the vulnerability, including Armory Castle (UNC5221), a China-nexus cyber espionage group. Armory Castle exploited the vulnerability in late August 2026 for initial access into target networks and deployed custom tools, according to Proofpoint.
In a security advisory, BeyondTrust recommended that organizations with affected self-hosted Remote Support appliances apply the BT26-05-RS patch immediately. Organizations on a self-hosted Remote Support version prior to 24.3.1 must upgrade to a supported version first, then apply the patch.
CISA is urging organizations with affected self-hosted Remote Support appliances to take the following actions immediately:
- Apply the BT26-05-RS patch, as outlined in BeyondTrust's Security Advisory BT26-05
- Upgrade to a supported version of BeyondTrust Remote Support (24.3.1 and later) before applying the patch
- Monitor for indicators of compromise (IOCs) related to the vulnerability
- Review the mitigation steps provided by BeyondTrust and implement as needed
CISA's KEV catalog is a list of CVEs that are known to be actively exploited by threat actors. BOD 26-04 requires federal agencies to prioritize the remediation of vulnerabilities identified in the KEV catalog.
Why it matters
CISA's urgent directive to patch a critical vulnerability in BeyondTrust Remote Support highlights the urgent need for organizations to prioritize timely vulnerability patching. The authentication bypass flaw, actively exploited by cyber threat actors for initial access, underscores the high risk of older, unsupported software versions. Patches are available for supported versions, but organizations must ensure their systems are properly updated to mitigate the risk of compromise. The rapid addition of CVE-2026-102764 to CISA's Known Exploited Vulnerabilities catalog further emphasizes the severity of the issue and the need for immediate remediation.
The exploitation of this vulnerability by Chinese APT Armory Castle demonstrates the real-world impact of unpatched software vulnerabilities. The attackers used the flaw to gain initial access, establish persistence, escalate privileges, and move laterally within the compromised network. This sequence of events is a common pattern for threat actors seeking to gain deep access to sensitive data and systems.
For IT teams, this vulnerability and its exploitation serve as a reminder of the importance of proactive vulnerability management. Regularly scanning for vulnerabilities, prioritizing patching based on risk, and ensuring timely deployment of security updates are critical practices for preventing security breaches. Failure to do so can lead to significant operational and reputational impacts in the event of a successful attack.
phpWhat to do
- Organizations using BeyondTrust Remote Support versions 26.2.3 and earlier must upgrade to a patched version as soon as possible.
- For supported versions 24.3.1 and later, apply the latest available patches immediately to mitigate the risk of exploitation.
- Review logs for signs of compromise and consider disconnecting and rebooting affected systems to prevent further activities.
- Implement multi-factor authentication (MFA) and other access controls to prevent unauthorized access to the system.
- Conduct a thorough vulnerability assessment and penetration testing to identify and remediate any other potential security gaps.
2TI lens
CISA's call to patch the critical authentication bypass vulnerability in BeyondTrust Remote Support highlights the ongoing challenge of securing remote access tools. As organizations increasingly rely on remote support and access solutions, it's crucial to remain vigilant about potential vulnerabilities and vulnerabilities. The rapid exploitation of this flaw by cyber threat actors underscores the need for proactive vulnerability management and timely patching to mitigate risks. Organizations should prioritize updating their remote support solutions and stay informed about emerging threats in the cybersecurity landscape.
Sources
- CISA News
- SecurityWeek
- The Hacker News
- The Record